diff options
author | darrenr <darrenr@FreeBSD.org> | 2000-05-24 02:19:15 +0000 |
---|---|---|
committer | darrenr <darrenr@FreeBSD.org> | 2000-05-24 02:19:15 +0000 |
commit | e5c660762538c5a9c59aedbfd6c8a2b401019b08 (patch) | |
tree | b9babea7d2ee5d6361ad9baa8f7d74cbd2e3d762 /contrib/ipfilter/man | |
parent | 87c84875a061fc697994b37a134decbb21763b1e (diff) | |
download | FreeBSD-src-e5c660762538c5a9c59aedbfd6c8a2b401019b08.zip FreeBSD-src-e5c660762538c5a9c59aedbfd6c8a2b401019b08.tar.gz |
fix conflicts
Diffstat (limited to 'contrib/ipfilter/man')
-rw-r--r-- | contrib/ipfilter/man/ipf.8 | 5 | ||||
-rw-r--r-- | contrib/ipfilter/man/ipfstat.8 | 96 | ||||
-rw-r--r-- | contrib/ipfilter/man/ipmon.8 | 28 |
3 files changed, 121 insertions, 8 deletions
diff --git a/contrib/ipfilter/man/ipf.8 b/contrib/ipfilter/man/ipf.8 index 9aa4536..423ae35 100644 --- a/contrib/ipfilter/man/ipf.8 +++ b/contrib/ipfilter/man/ipf.8 @@ -5,7 +5,7 @@ ipf \- alters packet filtering lists for IP packet input and output .SH SYNOPSIS .B ipf [ -.B \-AdDEInoPrsUvVyzZ +.B \-6AdDEInoPrsUvVyzZ ] [ .B \-l <block|pass|nomatch> @@ -31,6 +31,9 @@ Rules are added to the end of the internal lists, matching the order in which they appear when given to \fBipf\fP. .SH OPTIONS .TP +.B \-6 +This option is required to parse IPv6 rules and to have them loaded. +.TP .B \-A Set the list to make changes to the active list (default). .TP diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8 index 89adb85..bc81b5a 100644 --- a/contrib/ipfilter/man/ipfstat.8 +++ b/contrib/ipfilter/man/ipfstat.8 @@ -5,7 +5,27 @@ ipfstat \- reports on packet filter statistics and filter list .SH SYNOPSIS .B ipfstat [ -.B \-aAfghIinosv +.B \-6aAfghIinosv +] [ +.B \-d +<device> +] + +.B ipfstat -t +[ +.B \-C +] [ +.B \-D +<addrport> +] [ +.B \-P +<protocol> +] [ +.B \-S +<addrport> +] [ +.B \-T +<refresh time> ] [ .B \-d <device> @@ -22,15 +42,32 @@ is to retrieve and display the accumulated statistics which have been accumulated over time as the kernel has put packets through the filter. .SH OPTIONS .TP +.B \-6 +Display filter lists for IPv6, if available. +.TP .B \-a Display the accounting filter list and show bytes counted against each rule. .TP .B \-A Display packet authentication statistics. +.TP +.B \-C +This option is only valid in combination with \fB\-t\fP. +Display "closed" states as well in the top. Normally, a TCP connection is +not displayed when it reaches the CLOSE_WAIT protocol state. With this +option enabled, all state entries are displayed. .TP .BR \-d \0<device> Use a device other than \fB/dev/ipl\fP for interfacing with the kernel. .TP +.BR \-D \0<addrport> +This option is only valid in combination with \fB\-t\fP. Limit the state top +display to show only state entries whose destination IP address and port +match the addport argument. The addrport specification is of the form +ipaddress[,port]. The ipaddress and port should be either numerical or the +string "any" (specifying any ip address resp. any port). If the \fB\-D\fP +option is not specified, it defaults to "\fB\-D\fP any,any". +.TP .B \-f Show fragment state information (statistics) and held state information (in the kernel) if any is present. @@ -55,10 +92,38 @@ Show the "rule number" for each rule as it is printed. .B \-o Display the filter list used for the output side of the kernel IP processing. .TP +.BR \-P \0<protocol> +This option is only valid in combination with \fB\-t\fP. Limit the state top +display to show only state entries that match a specific protocol. The +argument can be a protocol name (as defined in \fB/etc/protocols\fP) or a +protocol number. If this option is not specified, state entries for any +protocol are specified. +.TP .B \-s Show packet/flow state information (statistics) and held state information (in the kernel) if any is present. .TP +.BR \-S \0<addrport> +This option is only valid in combination with \fB\-t\fP. Limit the state top +display to show only state entries whose source IP address and port match +the addport argument. The addrport specification is of the form +ipaddress[,port]. The ipaddress and port should be either numerical or the +string "any" (specifying any ip address resp. any port). If the \fB\-S\fP +option is not specified, it defaults to "\fB\-S\fP any,any". +.TP +.B \-t +Show the state table in a way similar to they way \fBtop(1)\fP shows the process +table. States can be sorted using a number of different ways. This options +requires \fBncurses(3)\fP and needs to be compiled in. It may not be available on +all operating systems. See below, for more information on the keys that can +be used while ipfstat is in top mode. +.TP +.BR \-T \0<refreshtime> +This option is only valid in combination with \fB\-t\fP. Specifies how often +the state top display should be updated. The refresh time is the number of +seconds between an update. Any postive integer can be used. The default (and +minimal update time) is 1. +.TP .B \-v Turn verbose mode on. Displays more debugging information. .SH SYNOPSIS @@ -70,6 +135,35 @@ parameters are present. When supplied with either \fB\-i\fP or \fB\-o\fP, it will retrieve and display the appropriate list of filter rules currently installed and in use by the kernel. +.SH STATE TOP +Using the \fB\-t\fP option \fBipfstat\fP will enter the state top mode. In +this mode the state table is displayed similar to the way \fBtop\fP displays +the process table. The \fB\-C\fP, \fB\-D\fP, \fB\-P\fP, \fB\-S\fP and\fB\-T\fP +commandline options can be used to restrict the state entries that will be +shown and to specify the frequency of display updates. +.PP +In state top mode, the following keys can be used to influence the displayed +information. \fBl\fP can be used to redraw the screen. \fBq\fP is used to +quit the program. \fBs\fP can be used to change the sorting criterion and +\fBr\fP can be used to reverse the sorting criterion. +.PP +States can be sorted by protocol number, by number of IP packets, by number +of bytes and by time-to-live of the state entry. The default is to sort by +the number of bytes. States are sorted in descending order, but you can use +the \fBr\fP key to sort them in ascending order. +.SH STATE TOP LIMITATIONS +It is currently not possible to interactively change the source, destination +and protocol filters or the refreh frequency. This must be done from the +command line. +.PP +The screen must have at least 80 columns. This is however not checked. +.PP +Only the first X-5 entries that match the sort and filter criteria are +displayed (where X is the number of rows on the display. There is no way to +see more entries. +.PP +No support for IPv6 +.PP .SH FILES /dev/kmem .br diff --git a/contrib/ipfilter/man/ipmon.8 b/contrib/ipfilter/man/ipmon.8 index b8b42a3..dbe9dc6 100644 --- a/contrib/ipfilter/man/ipmon.8 +++ b/contrib/ipfilter/man/ipmon.8 @@ -5,13 +5,15 @@ ipmon \- monitors /dev/ipl for logged packets .SH SYNOPSIS .B ipmon [ -.B \-aFhnstvxX +.B \-aDFhnpstvxX +] [ +.B "\-N <device>" ] [ .B "\-o [NSI]" ] [ .B "\-O [NSI]" ] [ -.B "\-N <device>" +.B "\-P <pidfile>" ] [ .B "\-S <device>" ] [ @@ -75,6 +77,10 @@ In order for \fBipmon\fP to properly work, the kernel option Open all of the device logfiles for reading log entries from. All entries are displayed to the same output 'device' (stderr or syslog). .TP +.B \-D +Cause ipmon to turn itself into a daemon. Using subshells or backgrounding +of ipmon is not required to turn it into an orphan so it can run indefinately. +.TP .B "\-f <device>" specify an alternative device/file from which to read the log information for normal IP Filter log records. @@ -100,14 +106,19 @@ Specify which log files you do not wish to read from. This is most sensibly used with the \fB-a\fP. Letters available as parameters to this are the same as for \fB-o\fP. .TP +.B \-p +Cause the port number in log messages to always be printed as a number and +never attempt to look it up as from \fI/etc/services\fP, etc. +.TP +.B \-P <pidfile> +Write the pid of the ipmon process to a file. By default this is +\fI//etc/opt/ipf/ipmon.pid\fP (Solaris), \fI/var/run/ipmon.pid\fP (44BSD +or later) or \fI/etc/ipmon.pid\fP for all others. +.TP .B \-s Packet information read in will be sent through syslogd rather than saved to a file. The default facility when compiled and installed is \fBlocal0\fP. The following levels are used: -.TP -.B "\-S <device>" -Set the logfile to be opened for reading state log records from to <device>. -.TP .IP .B LOG_INFO \- packets logged using the "log" keyword as the action rather @@ -123,6 +134,9 @@ than pass or block. \- packets which have been logged and which can be considered "short". .TP +.B "\-S <device>" +Set the logfile to be opened for reading state log records from to <device>. +.TP .B \-t read the input file/device in a manner akin to tail(1). .TP @@ -144,6 +158,8 @@ recorded data. /dev/ipnat .br /dev/ipstate +.br +/etc/services .SH SEE ALSO ipl(4), ipf(8), ipfstat(8), ipnat(8) .\".SH BUGS |