Visit The New, Modern Unix Linux Community

Linux and UNIX Man Pages

Test Your Knowledge in Computers #145
Difficulty: Easy
Unix popularized the hierarchical file system with arbitrarily nested subdirectories, originally introduced by Multics.
True or False?
Linux & Unix Commands - Search Man Pages

ippool(8) [freebsd man page]

IPPOOL(8)						      System Manager's Manual							 IPPOOL(8)

NAME
ippool - user interface to the IPFilter pools SYNOPSIS
ippool -a [-dnv] [-m <name>] [-o <role>] [-t <type>] [-T ttl] -i <ipaddr>[/<netmask>] ippool -A [-dnv] [-m <name>] [-o <role>] [-S <seed>] [-t <type>] ippool -f <file> [-dnuv] ippool -F [-dv] [-o <role>] [-t <type>] ippool -l [-dv] [-m <name>] [-t <type>] ippool -r [-dnv] [-m <name>] [-o <role>] [-t <type>] -i <ipaddr>[/<netmask>] ippool -R [-dnv] [-m <name>] [-o <role>] [-t <type>] ippool -s [-dtv] [-M <core>] [-N <namelist>] DESCRIPTION
Ippool is used to manage information stored in the IP pools subsystem of IPFilter. Configuration file information may be parsed and loaded into the kernel, currently configured pools removed or changed as well as inspected. The command line options used are broken into two sections: the global options and the instance specific options. GLOBAL OPTIONS
-d Toggle debugging of processing the configuration file. -n This flag (no-change) prevents ippool from actually making any ioctl calls or doing anything which would alter the currently running kernel. -v Turn verbose mode on. COMMAND OPTIONS
-a Add a new data node to an existing pool in the kernel. -A Add a new (empty) pool to the kernel. -f <file> Read in IP pool configuration information from the file and load it into the kernel. -F Flush loaded pools from the kernel. -l Display a list of pools currently loaded into the kernel. -r Remove an existing data node from a pool in the kernel. -R Remove an existing pool from within the kernel. -s Display IP pool statistical information. OPTIONS
-i <ipaddr>[/<netmask>] Sets the IP address for the operation being undertaken with an all-one's mask or, optionally, a specific netmask given in either the dotted-quad notation or a single integer. -m <name> Sets the pool name for the current operation. -M <core> Specify an alternative path to /dev/kmem to retrieve statistical information from. -N <namelist> Specify an alternative path to lookup symbol name information from when retrieving statistical information. -o <role> Sets the role with which this pool is to be used. Currently only ipf, auth and count are accepted as arguments to this option. -S <seed> Sets the hashing seed to the number specified. Only for use with hash type pools. -t <type> Sets the type of pool being defined. Myst be one of tree, hash, group-map. -T <ttl> Sets the expiration of the node being added. The timeout is expressed as a number of seconds. tree, hash, group-map. -u When parsing a configuration file, rather than load new pool data into the kernel, unload it. FILES
/dev/iplookup /etc/ippool.conf SEE ALSO
ippool(5), ipf(8), ipfstat(8) IPPOOL(8)

Check Out this Related Man Page

IPPOOL(5)							File Formats Manual							 IPPOOL(5)

NAME
ippool, ippool.conf - IP Pool file format DESCRIPTION
The format for files accepted by ippool is described by the following grammar: line ::= table | groupmap . table ::= "table" role tabletype . groupmap ::= "group-map" inout role number ipfgroup tabletype ::= ipftree | ipfhash . role ::= "role" "=" "ipf" . inout ::= "in" | "out" . ipftree ::= "type" "=" "tree" number "{" addrlist "}" . ipfhash ::= "type" "=" "hash" number hashopts "{" hashlist "}" . ipfgroup ::= setgroup hashopts "{" grouplist "}" | hashopts "{" setgrouplist "}" . setgroup ::= "group" "=" groupname . hashopts ::= size [ seed ] | seed . size ::= "size" number . seed ::= "seed" number . addrlist ::= [ "!" ] addrmask ";" [ addrlist ] . grouplist ::= groupentry ";" [ grouplist ] | addrmask ";" [ grouplist ] . setgrouplist ::= groupentry ";" [ setgrouplist ] . groupentry ::= addrmask "," setgroup . hashlist ::= hashentry ";" [ hashlist ] . hashentry ::= addrmask . addrmask ::= ipaddr | ipaddr "/" mask . mask ::= number | ipaddr . groupname ::= number | name . number ::= digit { digit } . ipaddr = host-num "." host-num "." host-num "." host-num . host-num = digit [ digit [ digit ] ] . digit ::= "0" | "1" | "2" | "3" | "4" | "5" | "6" | "7" | "8" | "9" . name ::= letter { letter | digit } . The IP pool configuration file is used for defining a single object that contains a reference to multiple IP address/netmask pairs. A pool may consist of a mixture of netmask sizes, from 0 to 32. At this point in time, only IPv4 addressing is supported. OVERVIEW
The IP pool configuration file provides for defining two different mechanisms for improving speed in matching IP addresses with rules. The first, table , defines a lookup table to provide a single reference in a filter rule to multiple targets and the second, group-map , pro- vides a mechanism to target multiple groups from a single filter line. The group-map command can only be used with filter rules that use the call command to invoke either fr_srcgrpmap or fr_dstgrpmap , to use the source or destination address, respectively, for determining which filter group to jump to next for continuation of filter packet pro- cessing. POOL TYPES
Two storage formats are provided: hash tables and tree structure. The hash table is intended for use with objects all containing the same netmask or a few different sized netmasks of non-overlapping address space and the tree is designed for being able to support exceptions to a covering mask, in addition to normal searching as you would do with a table. It is not possible to use the tree data storage type with group-map configuration entries. POOL ROLES
When a pool is defined in the configuration file, it must have an associated role. At present the only supported role is ipf. Future development will see futher expansion of their use by other sections of IPFilter code. EXAMPLES
The following examples show how the pool configuration file is used with the ipf configuration file to enhance the ability for the ipf con- figuration file to be succinct in meaning. 1 The first example shows how a filter rule makes reference to a specific pool for matching of the source address. pass in from pool/100 to any The pool configuration, which matches IP addresses 1.1.1.1 and any in 2.2.0.0/16, except for those in 2.2.2.0/24. table role = ipf type = tree number = 100 { 1.1.1.1/32; 2.2.0.0/16; !2.2.2.0/24 }; 2 The following ipf.conf extract uses the fr_srcgrpmap/fr_dstgrpmap lookups to use the group-map facility to lookup the next group to use for filter processing, providing the call filter rule is matched. call now fr_srcgrpmap/1010 in all call now fr_dstgrpmap/2010 out all pass in all group 1020 block in all group 1030 pass out all group 2020 block out all group 2040 A ippool configuration to work with the above ipf.conf file might look like this: group-map in role = ipf number = 1010 { 1.1.1.1/32, group = 1020; 3.3.0.0/16, group = 1030; }; group-map out role = ipf number = 2010 group = 2020 { 2.2.2.2/32; 4.4.0.0/16; 5.0.0.0/8, group = 2040; }; FILES
/dev/iplookup /etc/ippool.conf /etc/hosts SEE ALSO
ippool(8), hosts(5), ipf(5), ipf(8), ipnat(8) IPPOOL(5)

Featured Tech Videos