newsIPQ BDB filter - News

 
 
Show details for the latest news.

Latest News Approved
Released v1.07
     posted by ale2003, Wed 20 Jan 2021 12:37:52 PM UTC

Adding a category field to each description.  Categorized abuse can then be reported to external sites, for example AbudeIPDB.

Released v1.06
     posted by ale2003, Sat 02 Nov 2019 05:43:14 PM UTC

This release includes a redistribution of jsmn JSON parsing library.  It consists of a single include file.  Using that and libcurl an easily coded RDAP client, abuserdap makes its entry into ipqbdb. [...]

Released v1.05
     posted by ale2003, Thu 06 Jun 2019 12:04:08 PM UTC

Changes and new features:

ibd-parse:

  •    added optional IPv6 prefix in the <HOST> replacement, so as to catch IPv4-mapped or -compatible address,
  •    tweak log line adding descr for changes,
  •    add elapsed time in summary line,
[...]
Released v1.04
     posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC

Maintenance release enabling BDB version 5.*, and minor changes including:

  • Man pages for ibd-del, ibd-ban, and ibd-white.  More man pages will be added soon.
  • Allow multiple addresses to be passed in a single ibd-ban command.
  • Accept IPv4 mapped IPv6 addresses.  (These tools will only store IPv4 addresses until I get a real IPv6 host address to experiment with.)
  • Decay treatment tweaks:  Default value changed from 2 mins to 6 hours, and decay doubled on passing the threshold.
Released v1.03
     posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC

Changes and new features:

  • New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.


  • ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.


  • New options for ibd-judge allow to configure nfnetfilter buffer size, ENOBUFS error notification, and each
[...]
Use libnetfilter_queue 0.0.17 or better
     posted by ale2003, Fri 30 Jul 2010 06:37:55 PM UTC

After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced.  Ipqbdb v1.02 logs such error and continues to run smoothly.  That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated. [...]

Version 1.0 on 24 Jan 2010
     posted by ale2003, Sun 24 Jan 2010 06:46:53 PM UTC

In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are

  • terminate established connections by letting iptables send tcp-reset to the local server for packets marked guilty,
  • specify the target database size when deleting old records, and
  • collect statistics.
It works!
     posted by ale2003, Tue 23 Dec 2008 04:59:10 PM UTC

The 0.1 release has been running smoothly on a 64bit Intel debian system since December 16, 2008. It has a unique queue. Parsing consumes much more than actual filtering.

It did catch the lame dictionary attack that it has been designed to block! [...]

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code