IPQ BDB filter - News
posted by ale2003, Wed 20 Jan 2021 12:37:52 PM UTC
Adding a category field to each description. Categorized abuse can then be reported to external sites, for example AbudeIPDB.
posted by ale2003, Sat 02 Nov 2019 05:43:14 PM UTC
This release includes a redistribution of jsmn JSON parsing library. It consists of a single include file. Using that and libcurl an easily coded RDAP client, abuserdap makes its entry into ipqbdb. [...]
posted by ale2003, Thu 06 Jun 2019 12:04:08 PM UTC
Changes and new features:
ibd-parse:
- added optional IPv6 prefix in the <HOST> replacement, so as to catch IPv4-mapped or -compatible address,
- tweak log line adding descr for changes,
- add elapsed time in summary line,
posted by ale2003, Thu 12 Sep 2013 03:58:27 PM UTC
Maintenance release enabling BDB version 5.*, and minor changes including:
- Man pages for ibd-del, ibd-ban, and ibd-white. More man pages will be added soon.
- Allow multiple addresses to be passed in a single ibd-ban command.
- Accept IPv4 mapped IPv6 addresses. (These tools will only store IPv4 addresses until I get a real IPv6 host address to experiment with.)
- Decay treatment tweaks: Default value changed from 2 mins to 6 hours, and decay doubled on passing the threshold.
posted by ale2003, Thu 10 Mar 2011 06:44:09 PM UTC
Changes and new features:
- New option --exec-connkill (-e for short) in ibd-ban and ibd-parse. Detailed below.
- ibd-config displays the new configuration file, and also the maximum initial-count that the architecture supports.
- New options for ibd-judge allow to configure nfnetfilter buffer size, ENOBUFS error notification, and each
posted by ale2003, Fri 30 Jul 2010 06:37:55 PM UTC
After some months, it seems linking with the newer version of libnetfilter_queue fixes the behavior when a queue error is experienced. Ipqbdb v1.02 logs such error and continues to run smoothly. That error --recv() returning -1 retrieving a message from the queue-- happens very seldom and is still being investigated. [...]
posted by ale2003, Sun 24 Jan 2010 06:46:53 PM UTC
In the new version I've renamed the ipqbdbd daemon to ibd-judge, as it emits verdicts. That way it's easier to grep logs or processes. New features are
- terminate established connections by letting iptables send tcp-reset to the local server for packets marked guilty,
- specify the target database size when deleting old records, and
- collect statistics.
posted by ale2003, Tue 23 Dec 2008 04:59:10 PM UTC
The 0.1 release has been running smoothly on a 64bit Intel debian system since December 16, 2008. It has a unique queue. Parsing consumes much more than actual filtering.
It did catch the lame dictionary attack that it has been designed to block!
[...]