1.\" $NetBSD: blocklistctl.8,v 1.5 2025/10/25 16:56:27 christos Exp $ 2.\" 3.\" Copyright (c) 2015 The NetBSD Foundation, Inc. 4.\" All rights reserved. 5.\" 6.\" This code is derived from software contributed to The NetBSD Foundation 7.\" by Christos Zoulas. 8.\" 9.\" Redistribution and use in source and binary forms, with or without 10.\" modification, are permitted provided that the following conditions 11.\" are met: 12.\" 1. Redistributions of source code must retain the above copyright 13.\" notice, this list of conditions and the following disclaimer. 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 19.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21.\" PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22.\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28.\" POSSIBILITY OF SUCH DAMAGE. 29.\" 30.Dd October 25, 2025 31.Dt BLOCKLISTCTL 8 32.Os 33.Sh NAME 34.Nm blocklistctl 35.Nd display and change the state of the blocklistd database 36.Sh SYNOPSIS 37.Nm 38.Cm dump 39.Op Fl abdnrw 40.Op Fl D Ar dbname 41.Sh DESCRIPTION 42.Nm 43is a program used to display and change the state of the 44.Xr blocklistd 8 45database. 46The following sub-commands are supported: 47.Ss dump 48The following options are available for the 49.Cm dump 50sub-command: 51.Bl -tag -width indent 52.It Fl a 53Show all database entries, by default it shows only the active ones. 54Inactive entries will be shown with a last-access (or, with 55.Fl r , 56the remaining) time of 57.Ql never . 58.It Fl b 59Show only the blocked entries. 60.It Fl D Ar dbname 61Specify the location of the 62.Ic blocklistd 63database file to use. 64The default is 65.Pa /var/db/blocklistd.db . 66.It Fl d 67Increase debugging level. 68.It Fl n 69Don't display a header. 70.It Fl r 71Show the remaining blocked time instead of the last activity time. 72.It Fl w 73Normally the width of addresses is good for IPv4, the 74.Fl w 75flag, makes the display wide enough for IPv6 addresses. 76.El 77.Pp 78The output of the 79.Cm dump 80sub-command consists of a header (unless 81.Fl n 82was given) and one line for each record in the database, where each line 83has the following columns: 84.Bl -tag -width indent 85.It Ql rulename 86The packet filter rule name associated with the database entry, 87usually 88.Dv blocklistd . 89.It Ql address/ma:port 90The remote address, mask, and local port number of the client connection 91associated with the database entry. 92.It Ql id 93column will show the identifier for the packet filter rule associated 94with the database entry, though this may only be the word 95.Ql OK 96for packet filters which do not create a unique identifier for each rule. 97.It Ql nfail 98The number of 99.Em failures 100reported for the client on the noted port, as well as the number of 101failures allowed before blocking (or, with 102.Fl a , 103an asterisk 104.Aq * ) 105.It So last access Sc | So remaining time Sc 106The last time a the client was reported as attempting access, or, with 107.Fl r , 108the time remaining before the rule blocking the client will be removed. 109.El 110.Sh SEE ALSO 111.Xr blocklistd 8 112.Sh NOTES 113Sometimes the reported number of failed attempts can exceed the number 114of attempts that 115.Xr blocklistd 8 116is configured to block. 117This can happen either because the rule has been removed manually, or 118because there were more attempts in flight while the rule block was being 119added. 120This condition is normal; in that case 121.Xr blocklistd 8 122will first attempt to remove the existing rule, and then it will re-add 123it to make sure that there is only one rule active. 124.Sh HISTORY 125.Nm 126first appeared in 127.Nx 7 . 128.Fx 129support for 130.Nm 131was implemented in 132.Fx 11 . 133.Sh AUTHORS 134.An Christos Zoulas 135