Log overload rule

Article View: bit.listserv.openbsd-pf

Article #87

Back to bit.listserv.openbsd-pf Previous Next

#87

From: Helmut Schneider
Date: Mon, 13 Jun 2011 18:43

10 lines
1072 bytes

Hi,

pass in quick log proto tcp to (self) port 21 $SA_FLAGS (max-src-conn
75, max-src-conn-rate 75/5, overload <ftpconn_bruteforce> flush global)

Is it possible to find out/log which limit overloaded the rule? I want
to adjust the correct limits and knowing which limit was hit would be
very helpful.

Thanks, Helmut

Technical Details

Message-ID: <xn0hfbo6036qhp3000@news.gmane.org>

Path:

arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn

Show Full Headers

Complete Article Headers

X-Google-Thread: ff4ef,b9228ab77d9941b1,start
X-Google-NewGroupId: yes
X-Google-Attributes: gidbffa70e3,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news2.google.com!news1.google.com!npeer01.iad.highwinds-media.com!news.highwinds-media.com!feed-me.highwinds-media.com!spln!newsgate.newsguy.com!newsp.newsguy.com!mdrn
From: jumper99@gmx.de (Helmut Schneider)
Newsgroups: bit.listserv.openbsd-pf
Subject: Log overload rule
Date: 13 Jun 2011 11:43:02 -0700
Organization: None
Lines: 11
Message-ID: <xn0hfbo6036qhp3000@news.gmane.org>
NNTP-Posting-Host: jumper99
Mime-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
NNTP-Posting-Date: 13 Jun 2011 18:43:02 GMT