Update the README.txt some

1 files changed, 29 insertions, 0 deletions

diff --git a/README.txt b/README.txt
index 8370954..c1fbb24 100644
--- a/README.txt
+++ b/README.txt
@@ -29,3 +29,32 @@ You can see from the: % Information related to '117.221.0.0/20AS9829'
 that the net block in question is: 117.221.0.0/20. Often
 there is a CIDR: line with this info instead/also.
 
+
+Running:
+--------
+
+Block and unblock are fairly self explanitory so I wont talk about them
+
+theDrain has several ways it can be run. 
+
+Executing it as a non-privledged user take a quick look and print out stats on 
+half open connections.
+
+Executing it as root will do the same as above but blacklist any IPs with more 
+then $max_ho Half Open connections. 
+
+I find using something like:
+
+watch -n 5 theDrain
+
+as eiter root or nonpriv. depending  on the desire to monitor or monitor and block
+works very well. 
+
+theDrain also logs to a file drain.txt. So you can leave it running via watch and 
+come back later to see what was blocked. 
+
+It will also fire off e-mail alerts if it sees more then $alert_level Half Open 
+connections. sending the alert to the address specified in $alert_to
+
+Definitely take a look at the source and set the variable in a way that is sane for your use.
+