newsIPQ BDB filter - News: Released v1.03

 
 
Latest News
Released v1.07 posted by ale2003, Wed 20 Jan 2021 12:37:52 PM UTC
Released v1.06 posted by ale2003, Sat 02 Nov 2019 05:43:14 PM UTC
Released v1.05 posted by ale2003, Thu 06 Jun 2019 12:04:08 PM UTC
Released v1.04 posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC
Released v1.03 posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC

Released v1.03

Item posted by Alessandro Vesely <ale2003> on Thu 10 Mar 2011 06:44:09 PM UTC.

Changes and new features:

  • New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.


  • ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.


  • New options for ibd-judge allow to configure nfnetfilter buffer size, ENOBUFS error notification, and each queue's max length.


  • Most listing options of ibd-del (--ls, --ls-ban) now compute decay so as to display the percentage that would effectively result in case a packet arrives from the corresponding IP at the present time.


exec-connkill


When this option is given, if an updated address reaches 100% block probability then an external command is invoked.  The command is to be configured in a new configuration file, and presumably kills any established connection.  Using "conntrack -D" seems to work well, as it allows the stateful firewall to thereafter detect extraneous packets on its own.

This is more efficient than filtering each output packet in order to mark unwanted ones, as it doesn't imply queuing to user space. The two methods are not exactly equivalent, but they can be used concurrently.

 

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code