freebsd security - Feb 2004 - ipfw question

Dear All.

I want to use 'not' for 2 addresses (for both) in ipfw2 rule.
The only way that looks like what I need is

# ipfw add count from IP1 to not IP2,IP3

But does this rule indeed makes what I want? Does it count all
packets destined to addresses other then IP2 AND IP3?!

No other syntax works.
For example more logically correct
not IP2 AND not IP3
or even
not { IP2 or IP3 }
are understood by ipfw2

man does not contain the good description of this

Can somebody clear this up for me?

On Fri, Feb 06, 2004 at 01:17:06PM +0300, freebsd@tern.ru
wrote:
> Dear All.
> 
> I want to use 'not' for 2 addresses (for both) in ipfw2 rule.
> The only way that looks like what I need is
> 
> # ipfw add count from IP1 to not IP2,IP3
> 
> But does this rule indeed makes what I want? Does it count all
> packets destined to addresses other then IP2 AND IP3?!
> 
> No other syntax works.
> For example more logically correct
> not IP2 AND not IP3
> or even
> not { IP2 or IP3 }
> are understood by ipfw2
Could you try
  ipfw add count from IP1 to not { IP2,IP3 }

G'luck,
Peter

-- 
Peter Pentchev	roam@ringlet.net    roam@sbnd.net    roam@FreeBSD.org
PGP key:	http://people.FreeBSD.org/~roam/roam.key.asc
Key fingerprint	FDBA FD79 C26F 3C51 C95E  DF9E ED18 B68D 1619 4553
If I had finished this sentence,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url :
http://lists.freebsd.org/pipermail/freebsd-security/attachments/20040206/2ccd5512/attachment.bin