DBMGR(8)

NAME
dbmgr - Drawbridge Manager

SYNONPSIS
dbmgr [ command ]

DESCRIPTION

dbmgr is the manager portion of the Drawbridge system. It is used to control all functions of the Drawbridge filter engine within the kernel. It can be used to initialize, start, or stop Drawbridge as well as load or clear the filter configuration, set or show options, and monitor the operation of Drawbridge. With no arguments, dbmgr runs interactively, prompting with `dbmgr>'. If arguments are supplied, dbmgr interprets the first as a command to execute; each subsequent argument is taken as a parameter for that command. The standard input can be redirected so that dbmgr reads commands from a file.

USAGE

  Commands

Commands are case insentive and may be abbreviated to the capitalized portion. For example, CLeaR may be abbreviated to clr. If a '#' appears anywhere in a line of input, the remainder of that line will be treated as a comment. A '!' at the beginning of a line can be used as a shell escape.

? [ command ]
HELP [ command ]
Display a short description of the specified command or, if no arguments are given, a list of the recognized commands.

INIT <inside dev> <outside dev> <listen mode>
This command initializes the Drawbridge code within the kernel which must be done before Drawbridge will function. The only commands valid before init are set logfacility and set logmask. The <inside dev> is the device name of the inside interface, <outside dev> is the device name of the outside interface, and <listen mode> determines which interfaces will accept packets specifically addressed to the Drawbridge system. The valid listen modes are inside, outside, both, or none. If listening is enabled for an interface, packets from that interface which are addressed to the Drawbridge system will be accepted. Otherwise, they will be discarded. If listening is not enabled for either interface, all packets addressed to the Drawbridge system will be discarded and the system will be completely isolated from the network.

START
Drawbridge must be started before any packets will be passed between the inside and outside interfaces.

STOP
When Drawbridge is stoped, no packets will be passed between the inside and outside interfaces.

SET (LogFacility | LogMask) <val>

    LogFacility
    The LogFacility variable controls which messages are generated by drawbridge to be passed to the unix syslog daemon for processing. The log facility that drawbridge uses may be set to any valid syslog facility. Some examples are: "user", "daemon", "local0". The default is local0.

    LogMask
    The LogMask variable controls which messages will be generated by the drawbridge filter engine. The value of the mask is a hex or decimal number such as 0x123ABC or 1194684. The default log mask is 0 which disables all filter messages. The log mask may be determined by looking at the listing of syslog messages generated by the command `HELP set logmask'. Simply add up the decimal values (or bitwise OR the hex values) for the messages that you wish to receive and set LogMask to that value. Note that the syslog values are different than they were in version 2.x.

SET (MULticast | NonIP | OtherIP | SuspectOffset |
FragmentedICMP | AttackICMP) (FORward | DIScard)

    MULticast
    Controls whether IP multicast packets are forwarded or discarded. The default is 'forward'.

    NonIP
    Controls whether protocol layer traffic other than IP, ARP, or RARP is forwarded or discarded. The default is 'forward'.

    OtherIP
    Controls whether IP layer traffic other than TCP, UDP, or ICMP is forwarded or discarded. The default is 'forward'.

    SuspectOffset
    Controls whether TCP/IP fragments with an offset of 1 should be forwarded or discarded. This is mainly used to protect internal machines that may have poorly written IP fragment reassembly routines. The default setting is 'forward' since discarding these packets could, though unlikely, discard valid traffic.

    FragmentedICMP
    Controls whether fragmented ICMP packets should be forwarded or discarded. This is mainly used to block denial of service attacks which use fragmented ICMP echo reply packets. For example, the "ping of death" is a denial of service attack of this type. The default setting is 'forward' since discarding these packets could, though unlikely, discard valid traffic.

    AttackICMP
    Controls whether ICMP packets containing the characteristics of a few known ICMP attacks are forwarded or discarded. The default setting is 'forward' since discarding these packets could, though unlikely, discard valid traffic.

Load FILters <filename>
The load command is used to load the filter tables file 'db_filters' which is generated by the dbfc(8) filter compiler. The newly loaded tables will take effect immediately.

Clear (FILters | STats | BRidge)
The clear command can be used to clear the filter tables, the statistics, or the bridge table. If the filter tables are cleared, drawbridge will fall back to the default filter tables. The changes take effect immediately.

SHow (Host <host> | CLass <class | host> | NETworks |
ACCept | REJect | OVerride | FLags | STats |
LogFacility | LogMask | BRidge)
    The show command will display the specified filter table information, flags, variables, statistics, or the bridge table.

MONitor [ INTerval <val> ]
The monitor command will display a full screen of packet statistics which is updated once per second by default. The stats include total packets and total bytes for each interface, aggregate throughput, packets and bytes per second, number of bridge table entries, and number of dropped packets. The space bar will change screens to display a breakdown of the number of filtered packets. The 'q' key will quit back to the dbmgr> prompt.

EXIT
Exits the filter manager.

OPTIONS

-v  Output version and copyright message.

SEE ALSO
dbfc(8) and the documents COMPILER and README distributed with the Drawbridge system.