Ok, Im working here with ip chains:

I got the following setup:

/sbin/ipchains -N dkbhst
/sbin/ipchains -I input -j dkbhst
/sbin/ipchains -I output -j dkbhst
/sbin/ipchains -A dkbhst -s IP/255.255.255.255 -p all
/sbin/ipchains -A dkbhst -d IP/255.255.255.255 -p all

This basicly counts all traffic to the stated IP

Then I get the output:

3966 502K - all ------ 0xFF 0x00 any 128.xxx.xxx.0/27 anywhere n/a

5068 297K - all ------ 0xFF 0x00 any anywhere 128.xxx.xxx.0/27 n/a

Thats two, one outgoing, one incomming:
I got that with this command
/sbin/ipchains -L dkbhst -v

This is what I dont get, and I am new to ipchains, and well I typed in the ip address at the first few commands as 128.xxx.xxx.22 and in the output it lists as 128.xxx.xxx.0/27

Is that just their way of writting it, or is it tracking for all ips from 0 to 27?

Thanks

EDIT
Never mind, it was the netmask

Try using PMFirewall. This made configuring ipchains a snap!

If you dont get anything from ipchains -L try /sbin/ipchains -L

Seems as if you're not really entering:

/sbin/ipchains -N dkbhst
/sbin/ipchains -I input -j dkbhst
/sbin/ipchains -I output -j dkbhst
/sbin/ipchains -A dkbhst -s IP/255.255.255.255 -p all
/sbin/ipchains -A dkbhst -d IP/255.255.255.255 -p all

Instead, you are probably entering:

/sbin/ipchains -N dkbhst
/sbin/ipchains -I input -j dkbhst
/sbin/ipchains -I output -j dkbhst
/sbin/ipchains -A dkbhst -s IP/255.255.255.224 -p all
/sbin/ipchains -A dkbhst -d IP/255.255.255.224 -p all

or maybe even:

/sbin/ipchains -N dkbhst
/sbin/ipchains -I input -j dkbhst
/sbin/ipchains -I output -j dkbhst
/sbin/ipchains -A dkbhst -s IP/27 -p all
/sbin/ipchains -A dkbhst -d IP/27 -p all


Where IP is actually an IP address starting with 128 and being replaced with lots of x's in your post which makes it hard to determine what 32 IP addresses your /27 netmask actually covers. But it covers 32 IP addresses, and not 8.

Go here, to read about netmasks:

http://www.completeis.com/support/subnet/index.shtml

hey, sorry, I edited the post above, but I guess its easy to over look, I fixed it earlier, I removed the netmask