1 files changed, 61 insertions, 13 deletions
diff --git a/bin/blocklistctl.8 b/bin/blocklistctl.8
index 7c6521117745..d241f2844471 100644
--- a/bin/blocklistctl.8
+++ b/bin/blocklistctl.8
@@ -1,4 +1,4 @@
-.\" $NetBSD: blacklistctl.8,v 1.9 2016/06/08 12:48:37 wiz Exp $
+.\" $NetBSD: blocklistctl.8,v 1.6 2025/10/26 13:49:22 christos Exp $
 .\"
 .\" Copyright (c) 2015 The NetBSD Foundation, Inc.
 .\" All rights reserved.
@@ -27,27 +27,42 @@
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd June 7, 2016
-.Dt BLACKLISTCTL 8
+.Dd October 25, 2025
+.Dt BLOCKLISTCTL 8
 .Os
 .Sh NAME
-.Nm blacklistctl
-.Nd display and change the state of blacklistd
+.Nm blocklistctl
+.Nd display and change the state of the blocklistd database
 .Sh SYNOPSIS
 .Nm
 .Cm dump
 .Op Fl abdnrw
+.Op Fl D Ar dbname
 .Sh DESCRIPTION
 .Nm
-is a program used to display the state of
-.Xr blacklistd 8
-.Pp
-The following options are available:
+is a program used to display and change the state of the
+.Xr blocklistd 8
+database.
+The following sub-commands are supported:
+.Ss dump
+The following options are available for the
+.Cm dump
+sub-command:
 .Bl -tag -width indent
 .It Fl a
-Show all database entries, by default it shows only the embryonic ones.
+Show all database entries, by default it shows only the active ones.
+Inactive entries will be shown with a last-access (or, with
+.Fl r ,
+the remaining) time of
+.Ql never .
 .It Fl b
 Show only the blocked entries.
+.It Fl D Ar dbname
+Specify the location of the
+.Ic blocklistd
+database file to use.
+The default is
+.Pa /var/db/blocklistd.db .
 .It Fl d
 Increase debugging level.
 .It Fl n
@@ -59,18 +74,51 @@ Normally the width of addresses is good for IPv4, the
 .Fl w
 flag, makes the display wide enough for IPv6 addresses.
 .El
+.Pp
+The output of the
+.Cm dump
+sub-command consists of a header (unless
+.Fl n
+was given) and one line for each record in the database, where each line
+has the following columns:
+.Bl -tag -width indent
+.It Ql rulename
+The packet filter rule name associated with the database entry,
+usually
+.Dv blocklistd .
+.It Ql address/ma:port
+The remote address, mask, and local port number of the client connection
+associated with the database entry.
+.It Ql id
+column will show the identifier for the packet filter rule associated
+with the database entry, though this may only be the word
+.Ql OK
+for packet filters which do not create a unique identifier for each rule.
+.It Ql nfail
+The number of
+.Em failures
+reported for the client on the noted port, as well as the number of
+failures allowed before blocking (or, with
+.Fl a ,
+an asterisk
+.Aq * )
+.It So last access Sc | So remaining time Sc
+The last time a the client was reported as attempting access, or, with
+.Fl r ,
+the time remaining before the rule blocking the client will be removed.
+.El
 .Sh SEE ALSO
-.Xr blacklistd 8
+.Xr blocklistd 8
 .Sh NOTES
 Sometimes the reported number of failed attempts can exceed the number
 of attempts that
-.Xr blacklistd 8
+.Xr blocklistd 8
 is configured to block.
 This can happen either because the rule has been removed manually, or
 because there were more attempts in flight while the rule block was being
 added.
 This condition is normal; in that case
-.Xr blacklistd 8
+.Xr blocklistd 8
 will first attempt to remove the existing rule, and then it will re-add
 it to make sure that there is only one rule active.
 .Sh HISTORY