BLOCKLISTCTL(8)

💖 NAME 💖

okay so blocklistctl(8) — yes, the System Manager's Manual one — is the program that displays and changes the state of the blocklistd(8) database, bestie.

🌸 SYNOPSIS 🌸

blocklistctl dump [-abdnrw] [-D dbname]

✨ DESCRIPTION ✨

blocklistctl is the tool for displaying and changing the state of the blocklistd(8) database. The sub-command it supports is:

🗂️ dump 🗂️

Here are the options for the dump sub-command, no cap:

• -a — show all database entries. by default it shows only the active ones. inactive entries will be shown with a last-access time of never — or, with -r, the remaining time of never.
• -b — show only the blocked entries.
• -D dbname — specify the location of the blocklistd database file to use. the default is /var/db/blocklistd.db.
• -d — increase debugging level.
• -n — don't display a header.
• -r — show the remaining blocked time instead of the last activity time.
• -w — normally the width of addresses is good for IPv4; the -w flag makes the display wide enough for IPv6 addresses.

The output of the dump sub-command is a header (unless -n was given) plus one line for each record in the database, where each line has these columns:

• rulename — the packet filter rule name associated with the database entry, usually blocklistd.
• address/ma:port — the remote address, mask, and local port number of the client connection associated with the database entry.
• id — this column shows the identifier for the packet filter rule associated with the database entry, though this may only be the word OK for packet filters which do not create a unique identifier for each rule.
• nfail — the number of failures reported for the client on the noted port, as well as the number of failures allowed before blocking (or, with -a, an asterisk ⟨*⟩).
• last access | remaining time — the last time the client was reported as attempting access, or, with -r, the time remaining before the rule blocking the client will be removed.

👀 SEE ALSO 👀

• blocklistd(8)

🫶 NOTES 🫶

Sometimes the reported number of failed attempts can exceed the number of attempts that blocklistd(8) is configured to block. This can happen either because the rule has been removed manually, or because there were more attempts in flight while the rule block was being added. This condition is normal; in that case blocklistd(8) will first attempt to remove the existing rule, and then it will re-add it to make sure that there is only one rule active.

🕰️ HISTORY 🕰️

blocklistctl first appeared in NetBSD 7. FreeBSD support for blocklistctl was implemented in FreeBSD 11.

👑 AUTHORS 👑

Christos Zoulas

---

xoxo, Debian — October 25, 2025 💅