Jan Linders and Ray Olszewski wrote: > At 10:31 PM 12/28/01 +0100, Jan Linders wrote: > >Thx for the quick reply. > > > >By the latest i mean the most recent LRP version of > >Steinkuhler called Dachstein v1.0.2. which fits perfect on a 1660KB Floppy. > >Am i using a wrong LRP/LEAF setup ? > > Nope. Logging DENYd packets is pretty standard default behavior. And now > that you've identified the LEAF version you are using, someone can tell you > how to change its behavior to what you want. > > Only ... I'm not the someone. So I'm coptying this message back to the LEAF > list so someone who is running DachStein can tell you how to change its > logging behavior. (It is either a matter of removing the "-l" switch from > some ipchains command, or preceding it with a new DENY rule that does not > log the packets of concern, but I don't know exactly where in the DachStein
See info copied from another email to the list > scripts the relevant command is located.) > > -- > ------------------------------------"Never tell me the odds!"--- > Ray Olszewski -- Han Solo > Palo Alto, CA [EMAIL PROTECTED] > ---------------------------------------------------------------- Charles Steinkuehler and Scott C. Best wrote: > > > Regarding silent deny's...you can block the whole > > > 224.0.0.0/4 range (RFC-1112 Class-D multicast) without worry. > > > That catches IGMP, IGRP, EIGRP, and probably others. As you'd > > > expect, this is in the same "reduce my log noise" section of > > > echowall.rules. > > > > And, what is the best way to do this? > > > > Charles, is this possible with SILENT_DENY? > > SILENT_DENY="all_224.0.0.0/4" I finally wrote: I receive similar messages targeted for the 224.0.0.1 multicast address. You have to place your specific source address that is logged in messages.log file into the silent_deny variable to remedy the problem. This should work because there is usually just one of these nags sending to a multicast ip starting with 224. Also note that the interval between each of the multicast ips logged in messages.log file is the same number of minutes. In lrcfg use 1,1 or Network settings and Network configuration menu options. Find the silent_deny variable. Uncomment it by removing the # and change all the information between the quotes to read like this: # Traffic to completely ignore...define here to prevent filling your logs # Space seperated list: protocol_srcip[/mask][_dstport] SILENT_DENY="all_213.51.161.183" This address is based off your log of Dec 28 20:17:17 firewall kernel: Packet log: input DENY eth0 PROTO=17 213.51.161.183:520 224.0.0.9:520 L=72 S=0x00 I=6571 F=0x0000 T=1 (#40) save; backup the "etc" package; write protect your floppy; restart the network or reboot the firewall. The other way is to change ipfilter.conf, but it takes additional work to determine the rule to remove the -L, logging option from. Rule #40 is logging this message in your case. This solution should work for both the floppy based and cdrom base images. I have been making this change for years in ipfilter.conf. I just upgraded to v1.02 of the CD and used this technique. It worked as long as you have only a few source addresses to target. SILENT_DENY is a nice addition. Thanks Charles. > Is this for Source or Destination -- 224.0.0.0 ??? It should be the source IP. >If I understand the underlying code, your example will silently deny >everything from the 224.0.0.0/4 network, regardless to where >(destination) it is destined. I hope this helps, Greg Morgan _______________________________________________ Leaf-user mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user
