import ipfilter 4.1.8 into the vendor branch

21 files changed, 1316 insertions, 187 deletions

diff --git a/contrib/ipfilter/man/Makefile b/contrib/ipfilter/man/Makefile
index 05164d7..3f12ccb 100644
--- a/contrib/ipfilter/man/Makefile
+++ b/contrib/ipfilter/man/Makefile
@@ -1,9 +1,7 @@
 #
 # Copyright (C) 1993-1998 by Darren Reed.
 #
-# Redistribution and use in source and binary forms are permitted
-# provided that this notice is preserved and due credit is given
-# to the original author and the contributors.
+# See the IPFILTER.LICENCE file for details on licencing.
 #
 
 all:
@@ -12,12 +10,19 @@ install:
 	$(INSTALL) -m 0644 -c -o root -g bin ipftest.1 $(MANDIR)/man1
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.4 $(MANDIR)/man4
+	$(INSTALL) -m 0644 -c -o root -g bin ipfilter.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipl.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.4 $(MANDIR)/man4
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ipfilter.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipnat.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipf.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipfs.8 $(MANDIR)/man8
 	$(INSTALL) -m 0644 -c -o root -g bin ipmon.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ipmon.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ippool.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ippool.5 $(MANDIR)/man5
+	$(INSTALL) -m 0644 -c -o root -g bin ipscan.8 $(MANDIR)/man8
+	$(INSTALL) -m 0644 -c -o root -g bin ipscan.5 $(MANDIR)/man5
 	$(INSTALL) -m 0644 -c -o root -g bin ipfstat.8 $(MANDIR)/man8
 	@echo "Remember to rebuild the whatis database."
diff --git a/contrib/ipfilter/man/ipf.4 b/contrib/ipfilter/man/ipf.4
index 7d6436a..7a0b20a 100644
--- a/contrib/ipfilter/man/ipf.4
+++ b/contrib/ipfilter/man/ipf.4
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPF 4
 .SH NAME
 ipf \- packet filtering kernel interface
@@ -35,8 +37,8 @@ However, the full complement is as follows:
 	ioctl(fd, SIOCFRSYN, u_int *)
 	ioctl(fd, SIOCFRZST, struct friostat **)
 	ioctl(fd, SIOCZRLST, struct frentry **)
-	ioctl(fd, SIOCAUTHW, struct frauth_t **)
-	ioctl(fd, SIOCAUTHR, struct frauth_t **)
+	ioctl(fd, SIOCAUTHW, struct fr_info **)
+	ioctl(fd, SIOCAUTHR, struct fr_info **)
 	ioctl(fd, SIOCATHST, struct fr_authstat **)
 .fi
 .PP
@@ -122,7 +124,7 @@ Flags which are recognised in fr_flags:
      FR_RETRST       0x000080   /* return a TCP RST packet if blocked */
      FR_RETICMP      0x000100   /* return an ICMP packet if blocked */
      FR_FAKEICMP     0x00180    /* Return ICMP unreachable with fake source */
-     FR_NOMATCH      0x000200   /* No match occurred */
+     FR_NOMATCH      0x000200   /* no match occured */
      FR_ACCOUNT      0x000400   /* count packet bytes */
      FR_KEEPFRAG     0x000800   /* keep fragment information */
      FR_KEEPSTATE    0x001000   /* keep `connection' state information */
diff --git a/contrib/ipfilter/man/ipf.5 b/contrib/ipfilter/man/ipf.5
index 835d775..ab7f935 100644
--- a/contrib/ipfilter/man/ipf.5
+++ b/contrib/ipfilter/man/ipf.5
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPF 5
 .SH NAME
 ipf, ipf.conf, ipf6.conf \- IP packet filter rule syntax
@@ -19,12 +21,13 @@ described using the following grammar in BNF:
 \fC
 .nf
 filter-rule = [ insert ] action in-out [ options ] [ tos ] [ ttl ]
-	      [ proto ] [ ip ] [ group ].
+	      [ proto ] ip [ group ].
 
 insert	= "@" decnumber .
 action	= block | "pass" | log | "count" | skip | auth | call .
 in-out	= "in" | "out" .
-options	= [ log ] [ "quick" ] [ "on" interface-name [ dup ] [ froute ] ] .
+options	= [ log ] [ tag ] [ "quick" ] [ "on" interface-name [ dup ]
+           [ froute ] [ replyto ] ] .
 tos	= "tos" decnumber | "tos" hexnumber .
 ttl	= "ttl" decnumber .
 proto	= "proto" protocol .
@@ -32,19 +35,24 @@ ip	= srcdst [ flags ] [ with withopt ] [ icmp ] [ keep ] .
 group	= [ "head" decnumber ] [ "group" decnumber ] .
 
 block	= "block" [ return-icmp[return-code] | "return-rst" ] .
-auth    = "auth" | "preauth" .
 log	= "log" [ "body" ] [ "first" ] [ "or-block" ] [ "level" loglevel ] .
-call	= "call" [ "now" ] function-name .
+tag     = "tag" tagid .
 skip	= "skip" decnumber .
-dup	= "dup-to" interface-name[":"ipaddr] .
-froute	= "fastroute" | "to" interface-name[":"ipaddr] .
+auth	= "auth" | "preauth" .
+call	= "call" [ "now" ] function-name .
+dup	= "dup-to" interface-name [ ":" ipaddr ] .
+froute	= "fastroute" | "to" interface-name [ ":" ipaddr ] .
+replyto = "reply-to" interface-name [ ":" ipaddr ] .
 protocol = "tcp/udp" | "udp" | "tcp" | "icmp" | decnumber .
 srcdst	= "all" | fromto .
 fromto	= "from" [ "!" ] object "to" [ "!" ] object .
 
 return-icmp = "return-icmp" | "return-icmp-as-dest" .
+return-code = "(" icmp-code ")" .
 object	= addr [ port-comp | port-range ] .
 addr	= "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
+addr	= "any" | "<thishost>" | nummask |
+	  host-name [ "mask" ipaddr | "mask" hexnumber ] .
 port-comp = "port" compare port-num .
 port-range = "port" port-num range port-num .
 flags	= "flags" flag { flag } [ "/" flag { flag } ] .
@@ -205,6 +213,13 @@ indicates that, should this be the last matching rule, the packet
 header will be written to the \fBipl\fP log (as described in the
 LOGGING section below).
 .TP
+.B tag tagid
+indicates that, if this rule causes the packet to be logged or entered
+in the state table, the tagid will be logged as part of the log entry.
+This can be used to quickly match "similar" rules in scripts that post
+process the log files for e.g. generation of security reports or accounting
+purposes. The tagid is a 32 bit unsigned integer.
+.TP
 .B quick
 allows "short-cut" rules in order to speed up the filter or override
 later rules.  If a packet matches a filter rule which is marked as
@@ -374,7 +389,7 @@ against, e.g.:
 			# packets with ONLY the SYN flag set.
 
 	... flags SA
-			# becomes "flags SA/AUPRFSC" and will match any
+			# becomes "flags SA/AUPRFS" and will match any
 			# packet with only the SYN and ACK flags set.
 
 	... flags S/SA
diff --git a/contrib/ipfilter/man/ipf.8 b/contrib/ipfilter/man/ipf.8
index 60261d2..c7d07c0 100644
--- a/contrib/ipfilter/man/ipf.8
+++ b/contrib/ipfilter/man/ipf.8
@@ -1,14 +1,19 @@
+.\"	$NetBSD$
+.\"
 .TH IPF 8
 .SH NAME
 ipf \- alters packet filtering lists for IP packet input and output
 .SH SYNOPSIS
 .B ipf
 [
-.B \-6AdDEInoPrsUvVyzZ
+.B \-6AcdDEInoPrsvVyzZ
 ] [
 .B \-l
 <block|pass|nomatch>
 ] [
+.B \-T
+<optionlist>
+] [
 .B \-F
 <i|o|a|s|S>
 ]
@@ -36,6 +41,15 @@ This option is required to parse IPv6 rules and to have them loaded.
 .B \-A
 Set the list to make changes to the active list (default).
 .TP
+.B \-c <language>
+This option causes \fBipf\fP to generate output files for a compiler that
+supports \fBlanguage\fI.  At present, the only target language supported is
+\fBC\fB (-cc) for which two files - \fBip_rules.c\fP
+and \fBip_rules.h\fP are generated in the \fBCURRENT DIRECTORY\fP when
+\fBipf\fP is being run.  These files can be used with the
+\fBIPFILTER_COMPILED\fP kernel option to build filter rules staticly into
+the kernel.
+.TP
 .B \-d
 Turn debug mode on.  Causes a hexdump of filter rules to be generated as
 it processes each one.
@@ -58,7 +72,7 @@ To flush entries from the state table, the \fB-F\fP option is used in
 conjunction with either "s" (removes state information about any non-fully
 established connections) or "S" (deletes the entire state table).  Only
 one of the two options may be given.  A fully established connection
-will show up in \fBipfstat -s\fP output as 4/4, with deviations either
+will show up in \fBipfstat -s\fP output as 5/5, with deviations either
 way indicating it is not fully established any more.
 .TP
 .BR \-f \0<filename>
@@ -92,10 +106,22 @@ Remove matching filter rules rather than add them to the internal lists
 .TP
 .B \-s
 Swap the active filter list in use to be the "other" one.
-.TP
-.B \-U
-(SOLARIS 2 ONLY) Block packets travelling along the data stream which aren't
-recognised as IP packets.  They will be printed out on the console.
+.B \-T <optionlist>
+This option allows run-time changing of IPFilter kernel variables.  Some
+variables require IPFilter to be in a disabled state (\fB-D\fP) for changing,
+others do not.  The optionlist parameter is a comma separated list of tuning
+commands.  A tuning command is either "list" (retrieve a list of all variables
+in the kernel, their maximum, minimum and current value), a single variable
+name (retrieve its current value) and a variable name with a following
+assignment to set a new value.  Some examples follow.
+.nf
+# Print out all IPFilter kernel tunable parameters
+ipf -T list
+# Display the current TCP idle timeout and then set it to 3600
+ipf -D -T fr_tcpidletimeout,fr_tcpidletimeout=3600 -E
+# Display current values for fr_pass and fr_chksrc, then set fr_chksrc to 1.
+ipf -T fr_pass,fr_chksrc,fr_chksrc=1
+.fi
 .TP
 .B \-v
 Turn verbose mode on.  Displays information relating to rule processing.
diff --git a/contrib/ipfilter/man/ipfilter.4 b/contrib/ipfilter/man/ipfilter.4
new file mode 100644
index 0000000..cf8ca9f
--- /dev/null
+++ b/contrib/ipfilter/man/ipfilter.4
@@ -0,0 +1,241 @@
+.\"	$NetBSD$
+.\"
+.TH IP\ FILTER 4
+.SH NAME
+ipfilter \- Introduction to IP packet filtering
+.SH DESCRIPTION
+IP Filter is a TCP/IP packet filter, suitable for use in a firewall
+environment. To use, it can either be used as a loadable kernel module or
+incorporated into your UNIX kernel; use as a loadable kernel module where
+possible is highly recommended. Scripts are provided to install and patch
+system files, as required.
+.SH FEATURES
+The IP packet filter can:
+.IP
+explicitly deny/permit any packet from passing through
+.IP
+distinguish between various interfaces
+.IP
+filter by IP networks or hosts
+.IP
+selectively filter any IP protocol
+.IP
+selectively filter fragmented IP packets
+.IP
+selectively filter packets with IP options
+.IP
+send back an ICMP error/TCP reset for blocked packets
+.IP
+keep packet state information for TCP, UDP and ICMP packet flows
+.IP
+keep fragment state information for any IP packet, applying the same rule 
+to all fragments.
+.IP
+act as a Network Address Translator (NAT)
+.IP
+use redirection to setup true transparent proxy connections
+.IP
+provide packet header details to a user program for authentication
+.IP
+in addition, supports temporary storage of pre-authenticated rules for passing packets through
+.PP
+Special provision is made for the three most common Internet protocols, TCP,
+UDP and ICMP. The IP Packet filter allows filtering of:
+.IP
+Inverted host/net matchingTCP/UDP packets by port number or a port number
+range
+.IP
+ICMP packets by type/code
+.IP
+"established" TCP packets
+.IP
+On any arbitrary combination of TCP flags
+.IP
+"short" (fragmented) IP packets with incomplete headers can be filtered
+.IP
+any of the 19 IP options or 8 registered IP security classes TOS (Type of 
+Service) field in packets
+.PP
+To keep track of the performance of the IP packet filter, a logging device
+is used which supports logging of:
+.IP
+the TCP/UDP/ICMP and IP packet headers
+.IP
+the first 128 bytes of the packet (including headers)
+.PP
+A packet can be logged when:
+.IP
+it is successfully passed through
+.IP
+it is blocked from passing through
+.IP
+it matches a rule setup to look for suspicious packets
+.PP
+IP Filter keeps its own set of statistics on:
+.IP
+packets blocked 
+.IP
+packets (and bytes!) used for accounting
+.IP
+packets passed
+.lP
+packets logged
+.IP
+attempts to log which failed (buffer full)
+.IP
+and much more, for packets going both in and out.
+
+.SH Tools
+The current implementation provides a small set of tools, which can easily
+be used and integrated with regular unix shells and tools. A brief description 
+of the tools provided:
+.PP
+ipf(8)
+reads in a set of rules, from either stdin or a file, and adds them to
+the kernels current list (appending them). It can also be used to flush the
+current filter set or delete individual filter rules. The file format is
+described in ipf(5).
+.PP
+ipfs(8)
+is a utility to temporarily lock the IP Filter kernel tables (state tables
+and NAT mappings) and write them to disk. After that the system can be
+rebooted, and ipfs can be used to read these tables from disk and restore
+them into the kernel. This way the system can be rebooted without the 
+connections being terminated.
+.PP
+ipfstat(8)
+interrogates the kernel for statistics on packet filtering, so
+far, and retrieves the list of filters in operation for inbound and outbound
+packets.
+.PP
+ipftest(1)
+reads in a filter rule file and then applies sample IP packets to
+the rule file. This allows for testing of filter list and examination of how
+a packet is passed along through it.
+.PP
+ipmon(8)
+reads buffered data from the logging device (default is /dev/ipl)
+for output to either:
+.IP
+screen (standard output) 
+.IP
+file
+.IP
+syslog
+.PP
+ipsend(1)
+generates arbitary IP packets for ethernet connected machines.
+.PP
+ipresend(1)
+reads in a data file of saved IP packets (ie
+snoop/tcpdump/etherfind output) and sends it back across the network.
+.PP
+iptest(1)
+contains a set of test "programs" which send out a series of IP
+packets, aimed at testing the strength of the TCP/IP stack at which it is
+aimed at. WARNING: this may crash machine(s) targeted!
+.PP
+ipnat(8)
+reads in a set of rules, from either stdin or a file and adds them
+to the kernels current list of active NAT rules. NAT rules can also be
+deleted using ipnat. The format of the configuration file to be used
+with ipnat is described in ipnat(5).
+.PP
+For use in your own programs (e.g. for writing of transparent application
+proxies), the programming interface and the associated ioctl's are
+documented in ipf(4).
+
+Documentation on ioctl's and the format of data saved
+to the logging character device is provided in ipl(4)
+so that you may develop your own applications to work with or in place of any 
+of the above.
+
+Similar, the interface to the NAT code is documented in ipnat(4).
+
+.SH PACKET PROCESSING FLOW
+The following diagram illustrates the flow of TCP/IP packets through the 
+various stages introduced by IP Filter.
+.PP
+.nf
+                                   IN
+                                    |
+                                    V
+          +-------------------------+--------------------------+
+          |                         |                          |
+          |                         V                          |
+          |            Network Address Translation             |
+          |                         |                          |
+          |         authenticated   |                          |
+          |       +-------<---------+                          |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       V           IP Accounting                    |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       |        Fragment Cache Check--+             |
+          |       |                 |            |             |
+          |       V                 V            V             |
+          |       |         Packet State Check-->+             |
+          |       |                 |            |             |
+          |       |       +->--+    |            |             |
+          |       |       |    |    V            |             |
+          |       V   groups   IP Filtering      V             |
+          |       |       |    |    |            |             |
+          |       |       +--<-+    |            |             |
+          |       |                 |            |             |
+          |       +---------------->|<-----------+             |
+          |                         |                          |
+          |                         V                          |
+          |                +---<----+                          |
+          |                |        |                          |
+          |            function     |                          |
+          |                |        V                          |
+          |                +--->----+                          |
+          |                         |                          |
+          |                         V                          |
+       +--|---<--- fast-route ---<--+                          |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       |                            |
+       |                            V
+       V               [KERNEL TCP/IP Processing]
+       |                            |
+       |  +-------------------------+--------------------------+
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |                Fragment Cache Check--+             |
+       |  |                         |            |             |
+       |  |                         V            V             |
+       |  |                 Packet State Check-->+             |
+       |  |                         |            |             |
+       |  |                         V            |             |
+       V  |                    IP Filtering      |             |
+       |  |                         |            V             |
+       |  |                         |<-----------+             |
+       |  |                         V                          |
+       |  |                   IP Accounting                    |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |            Network Address Translation             |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       V                            |
+       +--------------------------->|
+                                    V
+                                   OUT
+.fi
+
+.SH MORE INFORMATION
+More information (including pointers to the FAQ and the mailing list) can be
+obtained from the sofware's official homepage: www.ipfilter.org
+
+.SH SEE ALSO
+ipf(4), ipf(5), ipf(8), ipfilter(5), ipfs(8), ipfstat(8), ipftest(1),
+ipl(4), ipmon(8), ipnat(8), ipnat(4),
+
diff --git a/contrib/ipfilter/man/ipfilter.4.mandoc b/contrib/ipfilter/man/ipfilter.4.mandoc
new file mode 100644
index 0000000..72534a7
--- /dev/null
+++ b/contrib/ipfilter/man/ipfilter.4.mandoc
@@ -0,0 +1,267 @@
+.Dd December 8, 2000
+.Dt IP\ FILTER 4
+.Os
+.Sh NAME
+.Nm IP Filter
+.Nd Introduction to IP packet filtering
+.Sh DESCRIPTION
+IP Filter is a TCP/IP packet filter, suitable for use in a firewall
+environment. To use, it can either be used as a loadable kernel module or
+incorporated into your UNIX kernel; use as a loadable kernel module where
+possible is highly recommended. Scripts are provided to install and patch
+system files, as required.
+.Sh FEATURES
+The IP packet filter can:
+.Bl -bullet -offset indent -compact
+.It
+explicitly deny/permit any packet from passing through
+.It
+distinguish between various interfaces
+.It
+filter by IP networks or hosts
+.It
+selectively filter any IP protocol
+.It
+selectively filter fragmented IP packets
+.It
+selectively filter packets with IP options
+.It
+send back an ICMP error/TCP reset for blocked packets
+.It
+keep packet state information for TCP, UDP and ICMP packet flows
+.It
+keep fragment state information for any IP packet, applying the same rule 
+to all fragments.
+.It
+act as a Network Address Translator (NAT)
+.It
+use redirection to setup true transparent proxy connections
+.It
+provide packet header details to a user program for authentication
+.It
+in addition, supports temporary storage of pre-authenticated rules for passing packets through
+.El
+.Pp
+Special provision is made for the three most common Internet protocols, TCP,
+UDP and ICMP. The IP Packet filter allows filtering of:
+.Bl -bullet -offset indent -compact
+.It
+Inverted host/net matchingTCP/UDP packets by port number or a port number
+range
+.It
+ICMP packets by type/code
+.It
+"established" TCP packets
+.It
+On any arbitrary combination of TCP flags
+.It
+"short" (fragmented) IP packets with incomplete headers can be filtered
+.It
+any of the 19 IP options or 8 registered IP security classes TOS (Type of 
+Service) field in packets
+.El
+.Pp
+To keep track of the performance of the IP packet filter, a logging device
+is used which supports logging of:
+.Bl -bullet -offset indent -compact
+.It
+the TCP/UDP/ICMP and IP packet headers
+.It
+the first 128 bytes of the packet (including headers)
+.El
+.Pp
+A packet can be logged when:
+.Bl -bullet -offset indent -compact
+.It
+it is successfully passed through
+.It
+it is blocked from passing through
+.It
+it matches a rule setup to look for suspicious packets
+.El
+.Pp
+IP Filter keeps its own set of statistics on:
+.Bl -bullet -offset indent -compact
+.It
+packets blocked 
+.It
+packets (and bytes!) used for accounting
+.It
+packets passed
+.li
+packets logged
+.It
+attempts to log which failed (buffer full)
+.El
+and much more, for packets going both in and out.
+
+.Sh Tools
+The current implementation provides a small set of tools, which can easily
+be used and integrated with regular unix shells and tools. A brief description 
+of the tools provided:
+.Pp
+.Xr ipf 8
+reads in a set of rules, from either stdin or a file, and adds them to
+the kernels current list (appending them). It can also be used to flush the
+current filter set or delete individual filter rules. The file format is
+described in
+.Xr ipf 5 .
+.Pp
+.Xr ipfs 8
+is a utility to temporarily lock the IP Filter kernel tables (state tables
+and NAT mappings) and write them to disk. After that the system can be
+rebooted, and ipfs can be used to read these tables from disk and restore
+them into the kernel. This way the system can be rebooted without the 
+connections being terminated.
+.Pp
+.Xr ipfstat 8
+interrogates the kernel for statistics on packet filtering, so
+far, and retrieves the list of filters in operation for inbound and outbound
+packets.
+.Pp
+.Xr ipftest 1
+reads in a filter rule file and then applies sample IP packets to
+the rule file. This allows for testing of filter list and examination of how
+a packet is passed along through it.
+.Pp
+.Xr ipmon 8
+reads buffered data from the logging device (default is /dev/ipl)
+for output to either:
+.Bl  -bullet -offset indent -compact
+.It
+screen (standard output) 
+.It
+file
+.It
+syslog
+.El
+.Pp
+.Xr ipsend 1
+generates arbitary IP packets for ethernet connected machines.
+.Pp
+.Xr ipresend 1
+reads in a data file of saved IP packets (ie
+snoop/tcpdump/etherfind output) and sends it back across the network.
+.Pp
+.Xr iptest 1
+contains a set of test "programs" which send out a series of IP
+packets, aimed at testing the strength of the TCP/IP stack at which it is
+aimed at. WARNING: this may crash machine(s) targeted!
+.Pp
+.Xr ipnat 8
+reads in a set of rules, from either stdin or a file and adds them
+to the kernels current list of active NAT rules. NAT rules can also be
+deleted using ipnat. The format of the configuration file to be used
+with ipnat is described in 
+.Xr ipnat 5 .
+.Pp
+For use in your own programs (e.g. for writing of transparent application
+proxies), the programming interface and the associated ioctl's are
+documented in
+.Xr ipf 4 .
+
+Documentation on ioctl's and the format of data saved
+to the logging character device is provided in
+.Xr ipl 4 
+so that you may develop your own applications to work with or in place of any 
+of the above.
+
+Similar, the interface to the NAT code is documented in 
+.Xr ipnat 4 .
+
+.Sh PACKET PROCESSING FLOW
+The following diagram illustrates the flow of TCP/IP packets through the 
+various stages introduced by IP Filter.
+.Pp
+.nf
+                                   IN
+                                    |
+                                    V
+          +-------------------------+--------------------------+
+          |                         |                          |
+          |                         V                          |
+          |            Network Address Translation             |
+          |                         |                          |
+          |         authenticated   |                          |
+          |       +-------<---------+                          |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       V           IP Accounting                    |
+          |       |                 |                          |
+          |       |                 V                          |
+          |       |        Fragment Cache Check--+             |
+          |       |                 |            |             |
+          |       V                 V            V             |
+          |       |         Packet State Check-->+             |
+          |       |                 |            |             |
+          |       |       +->--+    |            |             |
+          |       |       |    |    V            |             |
+          |       V   groups   IP Filtering      V             |
+          |       |       |    |    |            |             |
+          |       |       +--<-+    |            |             |
+          |       |                 |            |             |
+          |       +---------------->|<-----------+             |
+          |                         |                          |
+          |                         V                          |
+          |                +---<----+                          |
+          |                |        |                          |
+          |            function     |                          |
+          |                |        V                          |
+          |                +--->----+                          |
+          |                         |                          |
+          |                         V                          |
+       +--|---<--- fast-route ---<--+                          |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       |                            |
+       |                            V
+       V               [KERNEL TCP/IP Processing]
+       |                            |
+       |  +-------------------------+--------------------------+
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |                Fragment Cache Check--+             |
+       |  |                         |            |             |
+       |  |                         V            V             |
+       |  |                 Packet State Check-->+             |
+       |  |                         |            |             |
+       |  |                         V            |             |
+       V  |                    IP Filtering      |             |
+       |  |                         |            V             |
+       |  |                         |<-----------+             |
+       |  |                         V                          |
+       |  |                   IP Accounting                    |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  |            Network Address Translation             |
+       |  |                         |                          |
+       |  |                         V                          |
+       |  +-------------------------+--------------------------+
+       |                            |
+       |                        pass only
+       V                            |
+       +--------------------------->|
+                                    V
+                                   OUT
+.fi
+
+.Sh MORE INFORMATION
+More information (including pointers to the FAQ and the mailing list) can be
+obtained from the sofware's official homepage: www.ipfilter.org
+
+.Sh SEE ALSO
+.Xr ipf 4 ,
+.Xr ipf 5 ,
+.Xr ipf 8 ,
+.Xr ipfilter 5 ,
+.Xr ipfs 8 ,
+.Xr ipfstat 8 ,
+.Xr ipftest 1 ,
+.Xr ipl 4 ,
+.Xr ipmon 8 ,
+.Xr ipnat 4 ,
+.Xr ipnat 8 ,
+
diff --git a/contrib/ipfilter/man/ipfilter.5 b/contrib/ipfilter/man/ipfilter.5
index 0bba0f4..9fbb675 100644
--- a/contrib/ipfilter/man/ipfilter.5
+++ b/contrib/ipfilter/man/ipfilter.5
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPFILTER 1
 .SH NAME
 IP Filter
diff --git a/contrib/ipfilter/man/ipfs.8 b/contrib/ipfilter/man/ipfs.8
index b07935a..52f6fcb 100644
--- a/contrib/ipfilter/man/ipfs.8
+++ b/contrib/ipfilter/man/ipfs.8
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPFS 8
 .SH NAME
 ipfs \- saves and restores information for NAT and state tables.
@@ -54,7 +56,7 @@ and
 options for saving state information.
 .TP
 .B \-n
-Don't actually take any action that would effect information stored in
+Don't actually take any action that would affect information stored in
 the kernel or on disk.
 .TP
 .B \-v
@@ -90,17 +92,17 @@ and does not change the lock once complete.
 .B \-R
 Restores all saved state information, if any, from two files,
 \fIipstate.ipf\fP and \fIipnat.ipf\fP, stored in the \fI/var/db/ipf\fP
-directory unless otherwise specified the
+directory unless otherwise specified by the
 .B \-d
-option is used.  The state tables are locked at the beginning of this
+option.  The state tables are locked at the beginning of this
 operation and unlocked once complete.
 .TP
 .B \-W
 Saves in-kernel state information, if any, out to two files,
 \fIipstate.ipf\fP and \fIipnat.ipf\fP, stored in the \fI/var/db/ipf\fP
-directory unless otherwise specified the
+directory unless otherwise specified by the
 .B \-d
-option is used.  The state tables are locked at the beginning of this
+option.  The state tables are locked at the beginning of this
 operation and unlocked once complete.
 .DT
 .SH FILES
diff --git a/contrib/ipfilter/man/ipfstat.8 b/contrib/ipfilter/man/ipfstat.8
index c506a15..549b31a 100644
--- a/contrib/ipfilter/man/ipfstat.8
+++ b/contrib/ipfilter/man/ipfstat.8
@@ -1,18 +1,17 @@
+.\"	$NetBSD$
+.\"
 .TH ipfstat 8
 .SH NAME
 ipfstat \- reports on packet filter statistics and filter list
 .SH SYNOPSIS
 .B ipfstat
 [
-.B \-6aAfghIinosv
-] [
-.B \-d
-<device>
+.B \-6aAdfghIilnoRsv
 ]
-
+.br
 .B ipfstat -t
 [
-.B \-C
+.B \-6C
 ] [
 .B \-D
 <addrport>
@@ -25,12 +24,8 @@ ipfstat \- reports on packet filter statistics and filter list
 ] [
 .B \-T
 <refresh time>
-] [
-.B \-d
-<device>
 ]
 .SH DESCRIPTION
-.PP
 \fBipfstat\fP examines /dev/kmem using the symbols \fB_fr_flags\fP,
 \fB_frstats\fP, \fB_filterin\fP, and \fB_filterout\fP.
 To run and work, it needs to be able to read both /dev/kmem and the
@@ -42,7 +37,7 @@ accumulated over time as the kernel has put packets through the filter.
 .SH OPTIONS
 .TP
 .B \-6
-Display filter lists for IPv6, if available.
+Display filter lists and states for IPv6, if available.
 .TP
 .B \-a
 Display the accounting filter list and show bytes counted against each rule.
@@ -56,13 +51,13 @@ Display "closed" states as well in the top. Normally, a TCP connection is
 not displayed when it reaches the CLOSE_WAIT protocol state. With this
 option enabled, all state entries are displayed.
 .TP
-.BR \-d \0<device>
-Use a device other than \fB/dev/ipl\fP for interfacing with the kernel.
+.BR \-d
+Produce debugging output when displaying data.
 .TP
 .BR \-D \0<addrport>
 This option is only valid in combination with \fB\-t\fP. Limit the state top
 display to show only state entries whose destination IP address and port
-match the addport argument. The addrport specification is of the form
+match the addrport argument. The addrport specification is of the form
 ipaddress[,port].  The ipaddress and port should be either numerical or the
 string "any" (specifying any IP address resp. any port). If the \fB\-D\fP
 option is not specified, it defaults to "\fB\-D\fP any,any".
@@ -98,6 +93,10 @@ argument can be a protocol name (as defined in \fB/etc/protocols\fP) or a
 protocol number. If this option is not specified, state entries for any
 protocol are specified.
 .TP
+.BR \-R
+Don't try to resolve addresses to hostnames and ports to services while
+printing statistics.
+.TP
 .B \-s
 Show packet/flow state information (statistics only).
 .TP
@@ -107,15 +106,15 @@ Show held state information (in the kernel) if any is present (no statistics).
 .BR \-S \0<addrport>
 This option is only valid in combination with \fB\-t\fP. Limit the state top
 display to show only state entries whose source IP address and port match
-the addport argument. The addrport specification is of the form
+the addrport argument. The addrport specification is of the form
 ipaddress[,port].  The ipaddress and port should be either numerical or the
-string "any" (specifying any ip address resp. any port). If the \fB\-S\fP
+string "any" (specifying any IP address resp. any port). If the \fB\-S\fP
 option is not specified, it defaults to "\fB\-S\fP any,any".
 .TP
 .B \-t
-Show the state table in a way similar to they way \fBtop(1)\fP shows the process
-table. States can be sorted using a number of different ways. This options
-requires \fBncurses(3)\fP and needs to be compiled in. It may not be available on
+Show the state table in a way similar to the way \fBtop(1)\fP shows the process
+table. States can be sorted using a number of different ways. This option
+requires \fBcurses(3)\fP and needs to be compiled in. It may not be available on
 all operating systems. See below, for more information on the keys that can
 be used while ipfstat is in top mode.
 .TP
@@ -136,6 +135,10 @@ parameters are present.
 When supplied with either \fB\-i\fP or \fB\-o\fP, it will retrieve and display
 the appropriate list of filter rules currently installed and in use by the
 kernel.
+.PP
+One of the statistics that \fBipfstat\fP shows is \fBticks\fP.
+This number indicates how long the filter has been enabled.
+The number is incremented every half\-second.
 .SH STATE TOP
 Using the \fB\-t\fP option \fBipfstat\fP will enter the state top mode. In
 this mode the state table is displayed similar to the way \fBtop\fP displays
@@ -146,7 +149,9 @@ shown and to specify the frequency of display updates.
 In state top mode, the following keys can be used to influence the displayed
 information:
 .TP
-\fBd\fP select information to display.
+\fBb\fP show packets/bytes from backward direction.
+.TP
+\fBf\fP show packets/bytes from forward direction. (default)
 .TP
 \fBl\fP redraw the screen.
 .TP
@@ -166,13 +171,12 @@ and protocol filters or the refresh frequency. This must be done from the
 command line.
 .PP
 The screen must have at least 80 columns. This is however not checked.
+When running state top in IPv6 mode, the screen must be much wider to display
+the very long IPv6 addresses.
 .PP
 Only the first X-5 entries that match the sort and filter criteria are
-displayed (where X is the number of rows on the display. There is no way to 
-see more entries.
-.PP
-No support for IPv6
-.PP
+displayed (where X is the number of rows on the display. The only way to see
+more entries is to resize the screen.
 .SH FILES
 /dev/kmem
 .br
diff --git a/contrib/ipfilter/man/ipftest.1 b/contrib/ipfilter/man/ipftest.1
index bbfbc0c..4a17576 100644
--- a/contrib/ipfilter/man/ipftest.1
+++ b/contrib/ipfilter/man/ipftest.1
@@ -1,22 +1,36 @@
+.\"	$NetBSD$
+.\"
 .TH ipftest 1
 .SH NAME
 ipftest \- test packet filter rules with arbitrary input.
 .SH SYNOPSIS
 .B ipftest
 [
-.B \-vbdPRSTEHX
+.B \-6bdDoRvx
+] [
+.B \-F
+input-format
+] [
+.B \-i
+<filename>
 ] [
 .B \-I
 interface
-]
-.B \-r
+] [
+.B \-l
 <filename>
-[
-.B \-i
+] [
+.B \-N
 <filename>
 ] [
-.B \-s
-<ipaddress>
+.B \-P
+<filename>
+] [
+.B \-r
+<filename>
+] [
+.B \-T
+<optionlist>
 ]
 .SH DESCRIPTION
 .PP
@@ -25,70 +39,69 @@ filter rules without having to put them in place, in operation and proceed
 to test their effectiveness.  The hope is that this minimises disruptions
 in providing a secure IP environment.
 .PP
-\fBipftest\fP will parse any standard ruleset for use with \fBipf\fP
+\fBipftest\fP will parse any standard ruleset for use with \fBipf\fP,
+\fBipnat\fP and/or \fBippool\fP
 and apply input, returning output as to the result.  However, \fBipftest\fP
 will return one of three values for packets passed through the filter:
 pass, block or nomatch.  This is intended to give the operator a better
 idea of what is happening with packets passing through their filter
 ruleset.
 .PP
-When used without either of \fB\-S\fP, \fB\-T\fP or \fB\-E\fP,
-\fBipftest\fP uses its own text input format to generate "fake" IP packets.
-The format used is as follows:
-.nf
-		"in"|"out" "on" if ["tcp"|"udp"|"icmp"]
-			srchost[,srcport] dsthost[,destport] [FSRPAU]
-.fi
-.PP
-This allows for a packet going "in" or "out" of an interface (if) to be
-generated, being one of the three main protocols (optionally), and if
-either TCP or UDP, a port parameter is also expected.  If TCP is selected,
-it is possible to (optionally) supply TCP flags at the end.  Some examples
-are:
-.nf
-		# a UDP packet coming in on le0
-		in on le0 udp 10.1.1.1,2210 10.2.1.5,23
-		# an IP packet coming in on le0 from localhost - hmm :)
-		in on le0 localhost 10.4.12.1
-		# a TCP packet going out of le0 with the SYN flag set.
-		out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
-.fi
+At least one of \fB\-N\fP, \fB-P\fP or \fB\-r\fP must be specified.
 .SH OPTIONS
 .TP
-.B \-v
-Verbose mode.  This provides more information about which parts of rule
-matching the input packet passes and fails.
-.TP
-.B \-d
-Turn on filter rule debugging.  Currently, this only shows you what caused
-the rule to not match in the IP header checking (addresses/netmasks, etc).
+.B \-6
+Use IPv6.
 .TP
 .B \-b
 Cause the output to be a brief summary (one-word) of the result of passing
 the packet through the filter; either "pass", "block" or "nomatch".
 This is used in the regression testing.
 .TP
-.BR \-I \0<interface>
-Set the interface name (used in rule matching) to be the name supplied.
-This is useful with the \fB\-P, \-S, \-T\fP and \fB\-E\fP options, where it is
-not otherwise possible to associate a packet with an interface.  Normal
-"text packets" can override this setting.
+.B \-d
+Turn on filter rule debugging.  Currently, this only shows you what caused
+the rule to not match in the IP header checking (addresses/netmasks, etc).
 .TP
-.B \-P
+.B \-D
+Dump internal tables before exiting.
+This excludes log messages.
+.TP
+.B \-F
+This option is used to select which input format the input file is in.
+The following formats are available: etherfind, hex, pcap, snoop, tcpdump,text.
+.RS
+.TP
+.B etherfind
+The input file is to be text output from etherfind.  The text formats which
+are currently supported are those which result from the following etherfind
+option combinations:
+.PP
+.nf
+		etherfind -n
+		etherfind -n -t
+.fi
+.TP
+.B hex
+The input file is to be hex digits, representing the binary makeup of the
+packet.  No length correction is made, if an incorrect length is put in
+the IP header.  A packet may be broken up over several lines of hex digits,
+a blank line indicating the end of the packet.  It is possible to specify
+both the interface name and direction of the packet (for filtering purposes)
+at the start of the line using this format: [direction,interface]  To define
+a packet going in on le0, we would use \fB[in,le0]\fP - the []'s are required
+and part of the input syntax.
+.HP
+.B pcap
 The input file specified by \fB\-i\fP is a binary file produced using libpcap
 (i.e., tcpdump version 3).  Packets are read from this file as being input
 (for rule purposes).  An interface maybe specified using \fB\-I\fP.
 .TP
-.B \-R
-Remove rules rather than load them.  This is not a toggle option, so once
-set, it cannot be reset by further use of -R.
-.TP
-.B \-S
+.B snoop
 The input file is to be in "snoop" format (see RFC 1761).  Packets are read
 from this file and used as input from any interface.  This is perhaps the
 most useful input type, currently.
 .TP
-.B \-T
+.B tcpdump
 The input file is to be text output from tcpdump.  The text formats which
 are currently supported are those which result from the following tcpdump
 option combinations:
@@ -100,42 +113,77 @@ option combinations:
 		tcpdump -nqtt
 		tcpdump -nqte
 .fi
-.LP
 .TP
-.B \-H
-The input file is to be hex digits, representing the binary makeup of the
-packet.  No length correction is made, if an incorrect length is put in
-the IP header.  A packet may be broken up over several lines of hex digits,
-a blank line indicating the end of the packet.  It is possible to specify
-both the interface name and direction of the packet (for filtering purposes)
-at the start of the line using this format: [direction,interface]  To define
-a packet going in on le0, we would use \fB[in,le0]\fP - the []'s are required
-and part of the input syntax.
-.TP
-.B \-X
-The input file is composed of text descriptions of IP packets.
-.TP
-.B \-E
-The input file is to be text output from etherfind.  The text formats which
-are currently supported are those which result from the following etherfind
-option combinations:
+.B text
+The input file is in \fBipftest\fP text input format.
+This is the default if no \fB\-F\fP argument is specified.
+The format used is as follows:
+.nf
+	"in"|"out" "on" if ["tcp"|"udp"|"icmp"]
+		srchost[,srcport] dsthost[,destport] [FSRPAU]
+.fi
 .PP
+This allows for a packet going "in" or "out" of an interface (if) to be
+generated, being one of the three main protocols (optionally), and if
+either TCP or UDP, a port parameter is also expected.  If TCP is selected,
+it is possible to (optionally) supply TCP flags at the end.  Some examples
+are:
 .nf
-		etherfind -n
-		etherfind -n -t
+	# a UDP packet coming in on le0
+	in on le0 udp 10.1.1.1,2210 10.2.1.5,23
+	# an IP packet coming in on le0 from localhost - hmm :)
+	in on le0 localhost 10.4.12.1
+	# a TCP packet going out of le0 with the SYN flag set.
+	out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
 .fi
 .LP
+.RE
+.DT
 .TP
 .BR \-i \0<filename>
 Specify the filename from which to take input.  Default is stdin.
 .TP
+.BR \-I \0<interface>
+Set the interface name (used in rule matching) to be the name supplied.
+This is useful where it is
+not otherwise possible to associate a packet with an interface.  Normal
+"text packets" can override this setting.
+.TP
+.BR \-l \0<filename>
+Dump log messages generated during testing to the specified file.
+.TP
+.BR \-N \0<filename>
+Specify the filename from which to read NAT rules in \fBipnat\fP(5) format.
+.TP
+.B \-o
+Save output packets that would have been written to each interface in
+a file /tmp/\fIinterface_name\fP in raw format.
+.TP
+.BR \-P \0<filename>
+Read IP pool configuration information in \fBippool\fP(5) format from the
+specified file.
+.TP
 .BR \-r \0<filename>
-Specify the filename from which to read filter rules.
+Specify the filename from which to read filter rules in \fBipf\fP(5) format.
+.TP
+.B \-R
+Don't attempt to convert IP addresses to hostnames.
+.TP
+.BR \-T \0<optionlist>
+This option simulates the run-time changing of IPFilter kernel variables
+available with the \fB\-T\fP option of \fBipf\fP.
+The optionlist parameter is a comma separated list of tuning
+commands.  A tuning command is either "list" (retrieve a list of all variables
+in the kernel, their maximum, minimum and current value), a single variable
+name (retrieve its current value) and a variable name with a following
+assignment to set a new value.  See \fBipf\fP(8) for examples.
+.TP
+.B \-v
+Verbose mode.  This provides more information about which parts of rule
+matching the input packet passes and fails.
 .TP
-.BR \-s \0<ipaddress>
-Where the input format is incapable of telling \fBipftest\fP whther a packet is
-going in or out, setting this option to an IP address results in the direction
-being set to out if the source matches or in if the destination matches. 
+.B \-x
+Print a hex dump of each packet before printing the decoded contents.
 .SH SEE ALSO
 ipf(5), ipf(8), snoop(1m), tcpdump(8), etherfind(8c)
 .SH BUGS
diff --git a/contrib/ipfilter/man/ipl.4 b/contrib/ipfilter/man/ipl.4
index 0368f03..d45749b 100644
--- a/contrib/ipfilter/man/ipl.4
+++ b/contrib/ipfilter/man/ipl.4
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPL 4
 .SH NAME
 ipl \- IP packet log device
@@ -50,7 +52,7 @@ a buffer big enough to hold at least 1 complete log record - reading of partial
 log records is not supported.
 .PP
 If the packet contents are more than 128 bytes when \fBlog body\fP is used,
-then only 128 bytes of the packet contents is logged.
+then only 128 bytes of the packet contents are logged.
 .PP
 Although it is only possible to read from the \fBipl\fP device, opening it
 for writing is required when using an ioctl which changes any kernel data.
@@ -76,4 +78,4 @@ ipf(4)
 .SH BUGS
 Packet headers are dropped when the internal buffer (static size) fills.
 .SH FILES
-/dev/ipl
+/dev/ipl0
diff --git a/contrib/ipfilter/man/ipmon.5 b/contrib/ipfilter/man/ipmon.5
new file mode 100644
index 0000000..bc48466
--- /dev/null
+++ b/contrib/ipfilter/man/ipmon.5
@@ -0,0 +1,69 @@
+.\"	$NetBSD$
+.\"
+.TH IPMON 5
+.SH NAME
+ipmon, ipmon.conf \- ipmon configuration file format
+.SH DESCRIPTION
+The format for files accepted by ipmon is described by the following grammar:
+.LP
+.nf
+"match" "{" matchlist "}" "do" "{" doing "}" ";"
+
+matchlist ::= matching [ "," matching ] .
+matching  ::= direction | dstip | dstport | every | group | interface |
+              logtag | nattag | protocol | result | rule | srcip | srcport .
+
+dolist ::= doing [ "," doing ] .
+doing  ::= execute | save | syslog .
+
+direction ::= "in" | "out" .
+dstip     ::= "dstip" "=" ipv4 "/" number .
+dstport   ::= "dstport" "=" number .
+every     ::= "every" every-options .
+execute   ::= "execute" "=" string .
+group     ::= "group" "=" string | "group" "=" number .
+interface ::= "interface" "=" string .
+logtag    ::= "logtag" "=" string | "logtag" "=" number .
+nattag    ::= "nattag" "=" string .
+protocol  ::= "protocol" "=" string | "protocol" "=" number .
+result    ::= "result" "=" result-option .
+rule      ::= "rule" "=" number .
+srcip     ::= "srcip" "=" ipv4 "/" number .
+srcport   ::= "srcport" "=" number .
+type      ::= "type" "=" ipftype .
+ipv4      ::= number "." number "." number "." number .
+
+every-options ::= "second" | number "seconds" | "packet" | number "packets" .
+result-option ::= "pass" | "block" | "short" | "nomatch" | "log" .
+ipftype ::= "ipf" | "nat" | "state" .
+
+.fi
+.PP
+In addition, lines that start with a # are considered to be comments.
+.TP
+.SH OVERVIEW
+.PP
+The ipmon configuration file is used for defining rules to be executed when
+logging records are read from
+.B /dev/ipl.
+.PP
+At present, only IPv4 matching is available for source/destination address
+matching.
+.SH MATCHING
+.PP
+Each rule for ipmon consists of two primary segments: the first describes how
+the log record is to be matched, the second defines what action to take if
+there is a positive match.  All entries of the rules present in the file are
+compared for matches - there is no first or last rule match.
+.SH FILES
+/dev/ipl
+.br
+/dev/ipf
+.br
+/dev/ipnat
+.br
+/dev/ipstate
+.br
+/etc/ipmon.conf
+.SH SEE ALSO
+ipmon(8), ipl(4)
diff --git a/contrib/ipfilter/man/ipmon.8 b/contrib/ipfilter/man/ipmon.8
index 2827797..0c2861c 100644
--- a/contrib/ipfilter/man/ipmon.8
+++ b/contrib/ipfilter/man/ipmon.8
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH ipmon 8
 .SH NAME
 ipmon \- monitors /dev/ipl for logged packets
@@ -46,11 +48,8 @@ long).
 4. The group and rule number of the rule, e.g., \fB@0:17\fP. These can be
 viewed with \fBipfstat -n\fP.
 .LP
-5. The action: \fBp\fP for passed, \fBb\fP for blocked, \fBS\fP for a short
-packet, \fBn\fP did not match any rules, \fBL\fP for a log rule.  The order
-of precedence in showing flags is: S, p, b, n, L.  A capital \fBP\fP or
-\fBB\fP means that the packet has been logged due to a global logging
-setting, not a particular rule.
+5. The action: \fBp\fP for passed, \fBb\fP for blocked, \fB\fP for a short
+packet, \fBn\fP did not match any rules or \fBL\fP for a log rule.
 .LP
 6. The addresses.
 This is actually three fields: the source address and port
diff --git a/contrib/ipfilter/man/ipnat.4 b/contrib/ipfilter/man/ipnat.4
index 54f55d3..6f696bd 100644
--- a/contrib/ipfilter/man/ipnat.4
+++ b/contrib/ipfilter/man/ipnat.4
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPNAT 4
 .SH NAME
 ipnat \- Network Address Translation kernel interface
diff --git a/contrib/ipfilter/man/ipnat.5 b/contrib/ipfilter/man/ipnat.5
index 2bedd0c..7db3308 100644
--- a/contrib/ipfilter/man/ipnat.5
+++ b/contrib/ipfilter/man/ipnat.5
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH IPNAT 5
 .SH NAME
 ipnat, ipnat.conf \- IP NAT file format
@@ -7,45 +9,47 @@ The format for files accepted by ipnat is described by the following grammar:
 .nf
 ipmap :: = mapblock | redir | map .
 
-map ::= mapit ifname ipmask "->" dstipmask [ mapport ] mapoptions.
-map ::= mapit ifname fromto "->" dstipmask [ mapport ] mapoptions.
-mapblock ::= "map-block" ifname ipmask "->" ipmask [ ports ] mapoptions.
+map ::= mapit ifname lhs "->" dstipmask [ mapicmp | mapport | mapproxy ]
+        mapoptions .
+mapblock ::= "map-block" ifname lhs "->" ipmask [ ports ] mapoptions .
 redir ::= "rdr" ifname ipmask dport "->" ip [ "," ip ] rdrport rdroptions .
 
-dport ::= "port" number [ "-" number ] .
-ports ::= "ports" number | "auto" .
-rdrport ::= "port" number .
+lhs ::= ipmask | fromto .
+dport ::= "port" portnum [ "-" portnum ] .
+ports ::= "ports" numports | "auto" .
+rdrport ::= "port" portnum .
 mapit ::= "map" | "bimap" .
 fromto ::= "from" object "to" object .
 ipmask ::= ip "/" bits | ip "/" mask | ip "netmask" mask .
 dstipmask ::= ipmask | "range" ip "-" ip .
+mapicmp ::= "icmpidmap" "icmp" number ":" number .
 mapport ::= "portmap" tcpudp portspec .
 mapoptions ::= [ tcpudp ] [ "frag" ] [ age ] [ clamp ] .
-rdroptions ::= [ tcpudp | protocol ] [ rr ] [ "frag" ] [ age ] [ clamp ] .
+rdroptions ::= rdrproto [ rr ] [ "frag" ] [ age ] [ clamp ] [ rdrproxy ] .
 
-object  :: = addr [ port-comp | port-range ] .
-addr    :: = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
+object :: = addr [ port-comp | port-range ] .
+addr :: = "any" | nummask | host-name [ "mask" ipaddr | "mask" hexnumber ] .
 port-comp :: = "port" compare port-num .
 port-range :: = "port" port-num range port-num .
+rdrproto ::= tcpudp | protocol .
 
 rr ::= "round-robin" .
 age ::= "age" decnumber [ "/" decnumber ] .
 clamp ::= "mssclamp" decnumber .
-tcpudp ::= "tcp/udp" | "tcp" | "udp" .
+tcpudp ::= "tcp/udp" | protocol .
+mapproxy ::= "proxy" "port" port proxy-name '/' protocol
+rdrproxy ::= "proxy" proxy-name .
 
 protocol ::= protocol-name | decnumber .
-nummask ::= host-name [ "/" number ] .
-portspec ::= "auto" | number ":" number .
+nummask ::= host-name [ "/" decnumber ] .
+portspec ::= "auto" | portnumber ":" portnumber .
+port ::= portnumber | port-name .
+portnumber ::= number { numbers } .
 ifname ::= 'A' - 'Z' { 'A' - 'Z' } numbers .
 
-number ::= numbers [ number ] .
 numbers ::= '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' .
 .fi
 .PP
-In addition to this, # is used to mark the start of a comment and may
-appear at the end of a line with a NAT rule (as described above) or on its
-own lines.  Blank lines are ignored.
-.PP
 For standard NAT functionality, a rule should start with \fBmap\fP and then
 proceeds to specify the interface for which outgoing packets will have their
 source address rewritten.
@@ -101,41 +105,12 @@ or as
 map de0 from 10.1.0.0/16 to any -> 201.2.3.4/32
 .fi
 .LP
-For even greater control, one may negate either of the "from" or "to" clauses
-with a preceding exclamation mark ("!").  Please note that one may not use a
-negated "from" within a \fBmap\fP rule or a negated "to" within a \fBrdr\fP
-rule.  Such a rule might look like the following:
-.LP
-.nf
-+map de0 from 10.1.0.0/16 ! to 10.1.0.0/16 -> 201.2.3.4/32
-.fi
-.PP
 Only IP address and port numbers can be compared against.  This is available
 with all NAT rules.
-.SH COMMAND QUALIFIERS
-At the end of each rule, a number of qualifiers can be used to change how
-the rule works.  They are as follows:
-.TP
-protocol
-A specific protocol may be given either by its name (as found in
-/etc/protocols) or its number.  A special case for supporting both
-TCP and UDP is allowed with the name \fBtcp/udp\fP.
-.TP
-.B round-robin
-Once a rule with this term has been successfully used, it is put at the
-bottom of the list of those available so that each one will get used, in
-turn, in a list of matching left hand sides.
-.TP
-.B frag
-This qualifier is currently has no impact on NAT operation.
-.TP
-.B age
-If more refined timeouts are required than those available globally for
-NAT settings, this allows you to set them for \fBnon-TCP\fP use.
 .SH TRANSLATION
 .PP
 To the right of the "->" is the address and port specification which will be
-written into the packet providing it has already successful matched the
+written into the packet providing it has already successfully matched the
 prior constraints.  The case of redirections (\fBrdr\fP) is the simplest:
 the new destination address is that specified in the rule.  For \fBmap\fP
 rules, the destination address will be one for which the tuple combining
@@ -149,13 +124,76 @@ the packet will not be translated.  The \fBmap-block\fP is more limited in
 how it searches for a new, free and unique tuple, in that it will used an
 algorithm to determine what the new source address should be, along with the
 range of available ports - the IP address is never changed and nor does the
-port number ever exceed its alloted range.
+port number ever exceed its allotted range.
+.SH ICMPIDMAP
+.PP
+ICMP messages can be divided into two groups: "errors" and "queries". ICMP
+errors are generated as a response of another IP packet. IP Filter will take
+care that ICMP errors that are the response of a NAT-ed IP packet are
+handled properly.
+.PP
+For 4 types of ICMP queries (echo request, timestamp request, information 
+request and address mask request) IP Filter supports an additional mapping
+called "ICMP id mapping". All these 4 types of ICMP queries use a unique
+identifier called the ICMP id. This id is set by the process sending the
+ICMP query and it is usually equal to the process id. The receiver of the
+ICMP query will use the same id in its response, thus enabling the
+sender to recognize that the incoming ICMP reply is intended for him and is
+an answer to a query that he made. The "ICMP id mapping" feature modifies 
+these ICMP id in a way identical to \fBportmap\fP for TCP or UDP.
+.PP
+The reason that you might want this, is that using this feature you don't
+need an IP address per host behind the NAT box, that wants to do ICMP queries.
+The two numbers behind the \fBicmpidmap\fP keyword are the first and the
+last icmp id number that can be used. There is one important caveat: if you
+map to an IP address that belongs to the NAT box itself (notably if you have
+only a single public IP address), then you must ensure that the NAT box does
+not use the \fBicmpidmap\fP range that you specified in the \fBmap\fP rule.
+Since the ICMP id is usually the process id, it is wise to restrict the
+largest permittable process id (PID) on your operating system to e.g. 63999 and
+use the range 64000:65535 for ICMP id mapping. Changing the maximal PID is
+system dependent. For most BSD derived systems can be done by changing 
+PID_MAX in /usr/include/sys/proc.h and then rebuild the system.
 .SH KERNEL PROXIES
 .PP
 IP Filter comes with a few, simple, proxies built into the code that is loaded
 into the kernel to allow secondary channels to be opened without forcing the
-packets through a user program.
-.SH TRNSPARENT PROXIES
+packets through a user program.  The current state of the proxies is listed
+below, as one of three states:
+.HP
+Aging - protocol is roughly understood from
+the time at which the proxy was written but it is not well tested or
+maintained;
+.HP
+Developmental - basic functionality exists, works most of the time but
+may be problematic in extended real use;
+.HP
+Experimental - rough support for the protocol at best, may or may not
+work as testing has been at best sporadic, possible large scale changes
+to the code in order to properly support the protocol.
+.HP
+Mature - well tested, protocol is properly
+understood by the proxy;
+.PP
+The currently compiled in proxy list is as follows:
+.HP
+FTP - Mature
+.HP
+IRC - Experimental
+.HP
+rpcbind - Experimental
+.HP
+H.323 - Experimental
+.HP
+Real Audio (PNA) - Aging
+.HP
+IPsec - Developmental
+.HP
+netbios - Experimental
+.HP
+R-command - Mature
+
+.SH TRANSPARENT PROXIES
 .PP
 True transparent proxying should be performed using the redirect (\fBrdr\fP)
 rules directing ports to localhost (127.0.0.1) with the proxy program doing
@@ -226,7 +264,13 @@ map ppp0 172.192.0.0/16 -> 209.1.2.0/24 portmap tcp/udp auto
 .fi
 .PP
 which would result in each IP address being given a small range of ports to
-use (252).  The problem here is that the \fBmap\fP directive tells the NAT
+use (252).  In all cases, the new port number that is used is deterministic.
+That is, port X will always map to port Y.
+WARNING: It is not advisable to use the \fBauto\fP feature if you are map'ing
+to a /32 (i.e. 0/32) because the NAT code will try to map multiple hosts to
+the same port number, outgoing and ultimately this will only succeed for one
+of them.
+The problem here is that the \fBmap\fP directive tells the NAT
 code to use the next address/port pair available for an outgoing connection,
 resulting in no easily discernible relation between external addresses/ports
 and internal ones.  This is overcome by using \fBmap-block\fP as follows:
@@ -241,7 +285,6 @@ own.  As opposed to the above use of \fBmap\fP, if for some reason the user
 of (say) 172.192.0.2 wanted 260 simultaneous connections going out, they would
 be limited to 252 with \fBmap-block\fP but would just \fImove on\fP to the next
 IP address with the \fBmap\fP command.
-.SH FILES
 /dev/ipnat
 .br
 /etc/services
diff --git a/contrib/ipfilter/man/ipnat.8 b/contrib/ipfilter/man/ipnat.8
index 3b365ed..49a09be 100644
--- a/contrib/ipfilter/man/ipnat.8
+++ b/contrib/ipfilter/man/ipnat.8
@@ -1,10 +1,18 @@
+.\"	$NetBSD$
+.\"
 .TH IPNAT 8
 .SH NAME
-ipnat \- user interface to the NAT
+ipnat \- user interface to the NAT subsystem
 .SH SYNOPSIS
 .B ipnat
 [
-.B \-lnrsvCF
+.B \-dhlnrsvCF
+]
+[
+.B \-M core
+]
+[
+.B \-N system
 ]
 .B \-f <\fIfilename\fP>
 .SH DESCRIPTION
@@ -16,33 +24,48 @@ Each rule processed by \fBipnat\fP
 is added to the kernels internal lists if there are no parsing problems.
 Rules are added to the end of the internal lists, matching the order in
 which they appear when given to \fBipnat\fP.
+.PP
+Note that if
+\fBipf(8)\fP
+is not enabled when NAT is configured, it will be enabled
+automatically, as the same kernel facilities are used for
+NAT functionality.  In addition, packet forwarding must be
+enabled.
 .SH OPTIONS
 .TP
 .B \-C
 delete all entries in the current NAT rule listing (NAT rules)
+ .TP
+.B \-d
+Enable printing of some extra debugging information.
 .TP
 .B \-F
 delete all active entries in the current NAT translation table (currently
 active NAT mappings)
 .TP
+.B \-h
+Print number of hits for each MAP/Redirect filter.
+.TP
 .B \-l
 Show the list of current NAT table entry mappings.
 .TP
 .B \-n
-This flag (no-change) prevents \fBipnat\fP from actually making any ioctl
+This flag (no-change) prevents \fBipf\fP from actually making any ioctl
 calls or doing anything which would alter the currently running kernel.
 .TP
-.B \-s
-Retrieve and display NAT statistics
-.TP
 .B \-r
 Remove matching NAT rules rather than add them to the internal lists
 .TP
+.B \-s
+Retrieve and display NAT statistics
+.TP
 .B \-v
 Turn verbose mode on.  Displays information relating to rule processing
 and active rules/table entries.
 .DT
 .SH FILES
 /dev/ipnat
+.br
+/usr/share/examples/ipf  Directory with examples.
 .SH SEE ALSO
 ipnat(5), ipf(8), ipfstat(8)
diff --git a/contrib/ipfilter/man/ippool.5 b/contrib/ipfilter/man/ippool.5
new file mode 100644
index 0000000..c9eaaca
--- /dev/null
+++ b/contrib/ipfilter/man/ippool.5
@@ -0,0 +1,155 @@
+.\"	$NetBSD$
+.\"
+.TH IPPOOL 5
+.SH NAME
+ippool, ippool.conf \- IP Pool file format
+.SH DESCRIPTION
+The format for files accepted by ippool is described by the following grammar:
+.LP
+.nf
+line ::= table | groupmap .
+table ::= "table" role tabletype .
+groupmap ::= "group-map" inout role number ipfgroup
+tabletype ::= ipftree | ipfhash .
+
+role ::= "role" "=" "ipf" .
+inout ::= "in" | "out" .
+
+ipftree ::= "type" "=" "tree" number "{" addrlist "}" .
+ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" .
+
+ipfgroup ::= setgroup hashopts "{" grouplist "}" |
+             hashopts "{" setgrouplist "}" .
+setgroup ::= "group" "=" groupname .
+
+hashopts ::= size [ seed ] | seed .
+
+size ::= "size" number .
+seed ::= "seed" number .
+
+addrlist ::= [ "!" ] addrmask ";" [ addrlist ] .
+grouplist ::= groupentry ";" [ grouplist ] | addrmask ";" [ grouplist ] .
+
+setgrouplist ::= groupentry ";" [ setgrouplist ] .
+
+groupentry ::= addrmask "," setgroup .
+
+hashlist ::= hashentry ";" [ hashlist ] .
+hashentry ::= addrmask .
+
+addrmask ::= ipaddr | ipaddr "/" mask .
+
+mask ::= number | ipaddr .
+
+groupname ::= number | name .
+
+number ::= digit { digit } .
+
+ipaddr  = host-num "." host-num "." host-num "." host-num .
+host-num = digit [ digit [ digit ] ] .
+
+digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" .
+name ::= letter { letter | digit } .
+.fi
+.PP
+The IP pool configuration file is used for defining a single object that
+contains a reference to multiple IP address/netmask pairs.  A pool may consist
+of a mixture of netmask sizes, from 0 to 32.
+.PP
+At this point in time, only IPv4 addressing is supported.
+.TP
+.SH OVERVIEW
+.PP
+The IP pool configuration file provides for defining two different mechanisms
+for improving speed in matching IP addresses with rules.
+The first,
+.B table
+, defines a lookup
+.I table
+to provide a single reference in a
+filter rule to multiple targets and the second,
+.B group-map
+, provides a mechanism to target multiple groups from a single filter line.
+.PP
+The
+.B group-map
+command can only be used with filter rules that use the
+.B call
+command to invoke either
+.B fr_srcgrpmap
+or
+.B fr_dstgrpmap
+, to use the source or destination address,
+respectively, for determining which filter group to jump to next for
+continuation of filter packet processing.
+.SH POOL TYPES
+.PP
+Two storage formats are provided: hash tables and tree structure.  The hash
+table is intended for use with objects all containing the same netmask or a
+few different sized netmasks of non-overlapping address space and the tree
+is designed for being able to support exceptions to a covering mask, in
+addition to normal searching as you would do with a table.  It is not possible
+to use the tree data storage type with
+.B group-map
+configuration entries.
+.SH POOL ROLES
+.PP
+When a pool is defined in the configruation file, it must have an associated
+role.  At present the only supported role is
+.B ipf.
+Future development will see futher expansion of their use by other sections
+of IPFilter code.
+.SH EXAMPLES
+The following examples show how the pool configuration file is used with
+the ipf configuration file to enhance the ability for the ipf configuration
+file to be succinct in meaning.
+.TP
+1
+The first example shows how a filter rule makes reference to a specific
+pool for matching of the source address.
+.nf
+pass in from pool/100 to any
+.fi
+.PP
+The pool configuration, which matches IP addresses 1.1.1.1 and any
+in 2.2.0.0/16, except for those in 2.2.2.0/24.
+.PP
+.nf
+table role = ipf type = tree number = 100
+        { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 };
+.fi
+.TP
+2
+The following ipf.conf extract uses the
+fr_srcgrpmap/fr_dstgrpmap lookups to use the
+.B group-map
+facility to lookup the next group to use for filter processing, providing
+the
+.B call
+filter rule is matched.
+.nf
+call now fr_srcgrpmap/1010 in all
+call now fr_dstgrpmap/2010 out all
+pass in all group 1020
+block in all group 1030
+pass out all group 2020
+block out all group 2040
+.fi
+.PP
+A ippool configuration to work with the above ipf.conf file might
+look like this:
+.PP
+.nf
+group-map in role = ipf number = 1010
+	{ 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; };
+group-map out role = ipf number = 2010 group = 2020
+	{ 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; };
+.fi
+.SH FILES
+/dev/iplookup
+.br
+/etc/ippool.conf
+.br
+/etc/hosts
+.SH SEE ALSO
+ippool(8), hosts(5), ipf(5), ipf(8), ipnat(8)
diff --git a/contrib/ipfilter/man/ippool.8 b/contrib/ipfilter/man/ippool.8
new file mode 100644
index 0000000..6ed1e88
--- /dev/null
+++ b/contrib/ipfilter/man/ippool.8
@@ -0,0 +1,126 @@
+.\"	$NetBSD$
+.\"
+.TH IPPOOL 8
+.SH NAME
+ippool \- user interface to the IPFilter pools
+.SH SYNOPSIS
+.br
+.B ippool
+-a [-dnv] [-m <name>] [-o <role>] -i <ipaddr>[/<netmask>]
+.br
+.B ippool
+-A [-dnv] [-m <name>] [-o <role>] [-S <seed>] [-t <type>]
+.br
+.B ippool
+-f <file> [-dnuv]
+.br
+.B ippool
+-F [-dv] [-o <role>] [-t <type>]
+.br
+.B ippool
+-l [-dv] [-m <name>] [-t <type>]
+.br
+.B ippool
+-r [-dnv] [-m <name>] [-o <role>] -i <ipaddr>[/<netmask>]
+.br
+.B ippool
+-R [-dnv] [-m <name>] [-o <role>] [-t <type>]
+.br
+.B ippool
+-s [-dtv] [-M <core>] [-N <namelist>]
+.SH DESCRIPTION
+.PP
+.B Ippool
+is used to manage information stored in the IP pools subsystem of IPFilter.
+Configuration file information may be parsed and loaded into the kernel,
+currently configured pools removed or changed as well as inspected.
+.PP
+The command line options used are broken into two sections: the global
+options and the instance specific options.
+.SH GLOBAL OPTIONS
+.TP
+.B \-d
+Toggle debugging of processing the configuration file.
+.TP
+.B \-n
+This flag (no-change) prevents
+.B ippool
+from actually making any ioctl
+calls or doing anything which would alter the currently running kernel.
+.TP
+.B \-v
+Turn verbose mode on.
+.SH COMMAND OPTIONS
+.TP
+.B -a
+Add a new data node to an existing pool in the kernel.
+.TP
+.B -A
+Add a new (empty) pool to the kernel.
+.TP
+.B -f <file>
+Read in IP pool configuration information from the file and load it into
+the kernel.
+.TP
+.B -F
+Flush loaded pools from the kernel.
+.TP
+.B -l
+Display a list of pools currently loaded into the kernel.
+.TP
+.B -r
+Remove an existing data node from a pool in the kernel.
+.TP
+.B -R
+Remove an existing pool from within the kernel.
+.TP
+.B -s
+Display IP pool statistical information.
+.SH OPTIONS
+.TP
+.B -i <ipaddr>[/<netmask>]
+Sets the IP address for the operation being undertaken with an
+all-one's mask or, optionally, a specific netmask given in either
+the dotted-quad notation or a single integer.
+.TP
+.B -m <name>
+Sets the pool name for the current operation.
+.TP
+.B -M <core>
+Specify an alternative path to /dev/kmem to retrieve statistical information
+from.
+.TP
+.B -N <namelist>
+Specify an alternative path to lookup symbol name information from when
+retrieving statistical information.
+.TP
+.B -o <role>
+Sets the role with which this pool is to be used.  Currently only
+.B ipf,
+.B auth
+and
+.B count
+are accepted as arguments to this option.
+.TP
+.B -S <seed>
+Sets the hashing seed to the number specified.  Only for use with
+.B hash
+type pools.
+.TP
+.B -t <type>
+Sets the type of pool being defined.  Myst be one of
+.B tree,
+.B hash,
+.B group-map.
+.TP
+.B -u
+When parsing a configuration file, rather than load new pool data into the
+kernel, unload it.
+.DT
+.SH FILES
+.br
+/dev/iplookup
+.br
+/etc/ippool.conf
+.SH SEE ALSO
+ippool(5), ipf(8), ipfstat(8)
diff --git a/contrib/ipfilter/man/ipscan.5 b/contrib/ipfilter/man/ipscan.5
new file mode 100644
index 0000000..4a00174
--- /dev/null
+++ b/contrib/ipfilter/man/ipscan.5
@@ -0,0 +1,52 @@
+.\"	$NetBSD$
+.\"
+.TH IPSCAN 5
+.SH NAME
+ipscan, ipscan.conf \- ipscan file format
+.SH DESCRIPTION
+.PP
+WARNING: This feature is to be considered experimental and may change
+significantly until a final implementation is drawn up.
+.PP
+The format for files accept by ipscan currently follow this rough grammar:
+.LP
+.nf
+line     ::= name ":" matchup [ "," matchup ] "=" action .
+matchup  ::= "(" ")" | "(" literal ")" | "(" literal "," match ")" .
+action   ::= result | result "else" result .
+result   ::= "close" | "track" | redirect .
+redirect ::= "redirect" ip-address [ "(" "," port-number ")" ] .
+match    ::= { match-char }
+match-char ::= "*" | "?" | "."
+.fi
+.PP
+In this example an ip-address is a dotted-quad IPv4 address and a port-number
+is a number betwee 1 and 65535, inclusive.  The match string is must be of
+same length as the literal string that it is matching (literal).  The length
+of either string is limited to 16 bytes.
+.PP
+Currently, the redirect option is not yet been implemented.
+.LP
+.nf
+#
+# * = match any character, . = exact match, ? = case insensitive
+#
+# Scan for anything that looks like HTTP and redirect it to the local
+# proxy.  One catch - this feature (redirect) is not yet implemented.
+#
+http : ("GET ", "???." ) = redirect(127.0.0.1)
+#
+# Track ssh connections (i.e do nothing)
+#
+ssh : (), ("SSH-") = track
+#
+# Things which look like smtp to be tracked else closed.
+# Client can start with EHLO (ESMTP) or HELO (SMTP).
+#
+smtp : ("HELO ", "**??."), ("220 ", "....") = track else close
+#
+.fi
+.SH FILES
+/etc/ipscan.conf
+.SH SEE ALSO
+ipscan(8)
diff --git a/contrib/ipfilter/man/ipscan.8 b/contrib/ipfilter/man/ipscan.8
new file mode 100644
index 0000000..d3ce952
--- /dev/null
+++ b/contrib/ipfilter/man/ipscan.8
@@ -0,0 +1,44 @@
+.\"	$NetBSD$
+.\"
+.TH IPSCAN 8
+.SH NAME
+ipscan \- user interface to the IPFilter content scanning
+.SH SYNOPSIS
+.B ipscan
+[
+.B \-dlnrsv
+] [
+]
+.B \-f <\fIfilename\fP>
+.SH DESCRIPTION
+.PP
+\fBipscan\fP opens the filename given (treating "\-" as stdin) and parses the
+file to build up a content scanning configuration to load into the kernel.
+Currently only the first 16 bytes of a connection can be compared.
+.SH OPTIONS
+.TP
+.B \-d
+Toggle debugging of processing the configuration file.
+.TP
+.B \-l
+Show the list of currently configured content scanning entries.
+.TP
+.B \-n
+This flag (no-change) prevents \fBipscan\fP from actually making any ioctl
+calls or doing anything which would alter the currently running kernel.
+.TP
+.B \-r
+Remove commands from kernel configuration as they are read from the
+configuration file rather than adding new ones.
+.TP
+.B \-s
+Retrieve and display content scanning statistics
+.TP
+.B \-v
+Turn verbose mode on.
+.DT
+.SH FILES
+/dev/ipscan
+/etc/ipscan.conf
+.SH SEE ALSO
+ipscan(5), ipf(8)
diff --git a/contrib/ipfilter/man/mkfilters.1 b/contrib/ipfilter/man/mkfilters.1
index b5fd9dc..3bac7d1 100644
--- a/contrib/ipfilter/man/mkfilters.1
+++ b/contrib/ipfilter/man/mkfilters.1
@@ -1,3 +1,5 @@
+.\"	$NetBSD$
+.\"
 .TH MKFILTERS 1
 .SH NAME
 mkfilters \- generate a minimal firewall ruleset for ipfilter