On Thu, 6 Dec 2007, Mr. Johan Andersson wrote:
> excerpt from ipmon... > > 05/12/2007 14:16:28.112973 fjgi0 @0:31 b 217.28.202.24,25 -> > 81.228.11.98,35703 PR tcp len 20 52 -A IN OOW > 05/12/2007 14:16:28.142511 fjgi0 @0:31 b 195.47.247.173,25 -> > 81.228.11.98,38021 PR tcp len 20 84 -AFP IN OOW > 05/12/2007 14:16:28.612643 fjgi0 @0:31 b 195.47.247.173,25 -> > 81.228.11.98,38021 PR tcp len 20 52 -A IN OOW > 05/12/2007 14:16:29.221150 fjgi0 @0:31 b 130.235.83.227,25 -> > 81.228.11.98,63937 PR tcp len 20 52 -A IN OOW > 05/12/2007 14:16:29.472484 fjgi0 @0:31 b 194.116.198.17,25 -> > 81.228.11.98,33977 PR tcp len 20 40 -AF IN OOW > 05/12/2007 14:16:29.802263 fjgi0 @0:31 b 195.47.247.173,25 -> > 81.228.11.98,38021 PR tcp len 20 84 -AFP IN OOW I noticed all blocked packages have the OOW flag, I saw in a newsgroup that you can tune this with the age parameter. However, I cant find much info on how this is done and what parameter that tunes this globaly... I assume its one of the ipf -T list parameters, possibly in combination with ndd /dev/tcp and/or ndd /dev/ip What parameter controls the window time that these packages apparently timed out of? Awfully quiet mailing list this btw, no sound at all since I joined... /Johan A
