ipfw2 net.inet.ip.fw.verbose_limit broken

Jeremy Chadwick freebsd at jdc.parodius.com
Mon Aug 16 23:05:57 PDT 2004

Just wanted to toss this one up here.  Also, apologies for not
cross-posting this to freebsd-ipfw, but I'm not on the list; although
they seem to be aware of it:


Seems that ipfw2's support for net.inet.ip.fw.verbose_limit is, to
put it bluntly, broken.  This applies to both -STABLE and -CURRENT.
The following PR has been sitting around for quite some time...


I've managed to confirm this still exists even as of an August 5th build
of -CURRENT.  Using `logamount' directives per rule works properly as
a workaround.

I've also looked at the patch, although I'm not sure about the performance
implications of looking up a sysctl value per packet with a matching
ipfw2 `log' directive.

The ipfw2 code isn't something I feel even remotely comfortable tinkering
with, so if someone could take a poke at this (or contact the correct
people), that'd be great.


| Jeremy Chadwick                                 jdc at parodius.com |
| Parodius Networking                        http://www.parodius.com/ |
| UNIX Systems Administrator                   Mountain View, CA, USA |
| Making life hard for others since 1977.                             |

More information about the freebsd-current mailing list