How do I view log of dropped IP from default /var/log/pflog file?

Use tcpdump command to read a log file:
# tcpdump -n -e -ttt -r /var/log/pflog
# tcpdump -n -e -ttt -r /var/log/pflog port 80
# tcpdump -n -e -ttt -r /var/log/pflog and host 202.33.1.2
You can also view log in real time, enter:
# tcpdump -n -e -ttt -i pflog0
# tcpdump -n -e -ttt -i pflog0 port 80
# tcpdump -n -e -ttt -i pflog0 host 202.33.1.2

“How to”Patching OpenBSD 4.2 kernel and packages

cd /usr/src
wget ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.2/sys.tar.gz
wget ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/004_pf.patch
wget ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/005_ifrtlabel.patch
wget ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/007_tcprespond.patch
wget ftp://ftp.openbsd.org/pub/OpenBSD/patches/4.2/common/008_ip6rthdr.patch
tar zxvf sys.tar.gz
patch -p0 < 004_pf.patch
patch -p0 < 005_ifrtlabel.patch
patch -p0 < 007_tcprespond.patch
patch -p0 < 008_ip6rthdr.patch
cd /usr/src/sys/arch/`arch -s`/conf
config GENERIC && cd ../compile/GENERIC
make depend && make && sudo make install
reboot

pf.conf specified by using these operators

Ports and ranges of ports are specified by using these operators:

= (equal)
!= (unequal)
< (less than)
<= (less than or equal)
> (greater than)
>= (greater than or equal)
: (range including boundaries)
>< (range excluding boundaries)
<> (except range)

><, <> and : are binary operators (they take two arguments). For instance:

port 2000:2004
means `all ports >= 2000 and <= 2004′, hence ports
2000, 2001, 2002, 2003 and 2004.

port 2000 __ 2004
means `all ports > 2000 and < 2004′, hence ports 2001,
2002 and 2003.

port 2000 __ 2004
means `all ports < 2000 or > 2004′, hence ports 1-1999
and 2005-65535.

Color ls on OpenBSD

1. cd /usr/ports/sysutils/colorls
2. make install
3. set your TERM to wsvt25
4. /usr/local/bin/colorls -G should now display similar to the GNU ls with the color option
5. Set the appropriate alias for your shell.

vi .profile

export PS1=’\u@\h \w # ‘
export TERM=wsvt25
alias ls=’/usr/local/bin/colorls -G’
:wq!

done now with ls color

Useful geology commands

# To update the pf.conf-test file, copy the ruleset to the clipboard
# then use the following command then insert the new ruleset and save: rm /etc/pf.conf-test ; vi /etc/pf.conf-test

# To check syntax of the new pf.conf-test file. type:

pfctl -n -f /etc/pf.conf-test

# To load the updated pf.conf-test file into pf. type:

pfctl -F all ; pfctl -f /etc/pf.conf-test

# To clear the /var/log/pflog file and restart logging. type:

cat /dev/null > /var/log/pflog ; kill -HUP `cat /var/run/pflogd.pid`

# To view the current contents of the ssh bruteforce memory table, type:

pfctl -t bruteforce -T show

# To view the current contents of the badhosts memory table, type:

pfctl -t badhosts -T show

# To view the current contents of the badhosts memory table, with statistics, type:

pfctl -t badhosts -T show -v

# To reload the /etc/badhosts file into pf after updating the file, type:

pfctl -t badhosts -T replace -f /etc/badhosts

# To view addresses in the spamd-white table, type:

pfctl -t spamd-white -T show

# To load a new IP address into the spamd-white table, type:

pfctl -t spamd-white -T add ip-address

# To view blocked egress packets, assuming you default block out rule is “Rule 3″ and logging is enabled, type:

tcpdump -n -e -ttt -r /var/log/pflog > /tmp/blockout ; grep rule\ 3/ /tmp/blockout

pfctl -g -s rules| grep ‘^@’pfctl -sn
pfctl -sr
pfctl -ss
pfctl -si
pfctl -sa
pfctl -s rules -vv
pfctl -s queue -v
pfctl -s queue -v
netstat -s -ppfsync
pfctl -vsq
pfctl -vs Tables

Load Balancer
pftop -w 150 -a -b
pftop -w 150 -a -b -v long
pftop -w 150 -a -b -v queue
pftop -w 150 -a -b -v rules
pftop -w 150 -a -b -v size
pftop -w 150 -a -b -v speed

Create cd installer OpenBSD 4.2

IMPORTANT NOTE: Starting in OpenBSD v4.2 you can now just download the bootable iso “install42.iso” if you DO NOT want to customize your cd image. The “install42.iso” image has all of the files you need to install OpenBSD.

Make a bootable OpenBSD ISO image.

Note: Make sure that you have mkisofs and ncftpget installed before starting.

First we need to make a directory structure that will hold the files that we will be downloading from the OpenBSD mirror closest to you.

Remote Upgrade of OpenBSD 4.1 to 4.2

The first assumption is that you have a remote OpenBSD server running 4.1 with a serial port console.

Before you start, read the OpenBSD 4.2 upgrade faq here . For the most part, you will be following that faq. This is simply a supplemental guide to get things rolling…

I’m upgrading a i386 system. bsd.rd is the install/upgrade kernel. If we already have a remote system running, we can upgrade bsd.rd first, then boot from it and upgrade the rest of the system.

Install, reinstall windows vista ultimate

Welcome to Microsoft’s Windows Vista Ultimate Install guide step by step on a new/blank hard drive. This guide will show you how to install Windows Vista. This install guide is fully graphical and will take you through each step of the installation.

What you will require to do this walkthrough is

1. A Windows Vista Ultimate CD or DVD

2. A Computer with CD-ROM or DVD-ROM access

3. Bios set to boot of the CD/DVD-ROM drive. ( Check out this guide for help with the BIOS )

To start this Windows install insert the first CD or the DVD into the drive and start or restart your computer

More reading going here.

http://vistaultimate.windowsreinstall.com/installnewhdd/installnewhdd.htm

for bios setting:

http://www.windowsreinstall.com/articles/bios/

Building A OpenBSD-4.2-current (patched) CD

I have to update several OpenBSD systems so I find it easiest to make a 4.2-current (patched) distribution. This can also be burned to a cd so new installs or upgrades via cd are also patched.

So, I have just upgraded to 4.2 OpenBSD. I am now going to build a patched distribution, patching the system in the process.

Let’s do it: