blocking a string in a packet using ipfw

[Julian Elischer]

Oliver Fromme wrote:

>Willem Jan Withagen wrote:
> > Julian Elischer wrote:
> > > > Forgot to mention: 4.7-PRERELEASE :(
> > > 
> > > ugh... no tables
> > > and 45000 lines will be bad.
>
>Not necessarily ...
>
> > Over that time I collected over 50.000 IP's which all ended up
> > in IPFW. :) The box (PIII, 750 Mhz, 512Mb) started using a lot
> > of system and interrupt time, but it survived it all.
>
>I once wrote a small tool that took a bunch of IP addresses
>on stdin and converted it into IPFW "skipto" rules forming
>a binary tree.  So, in the worst case, only 32 rules had to
>be checked for each packet, instead of 50,000.
>
>  
>

yes I've done that too  but tables are such an improvement.
I back ported tabled from 4.10 to 4.8 for ironport last year and it 
wasn't any problem..
just copied back the relevant files and compiled with ipfw2.

it would probably work for 4.7 too.

>Of course, with IPFW2's table feature, that tool of mine
>became obsolete.
>
>Best regards
>   Oliver
>
>  
>