Re: PF and stalled connections

["Dom De Vitto" <dom@DeVitto.com>]

I think Henning means:
The state table grows/shrinks appropriately.

So (unlike other firewalls) you NEVER "run out" until you run out of
RAM (and maybe not even then - is the area swappable? Is any part of
the Obsd kernel swappable?)

Dom
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dom De Vitto                                       Tel. 07855 805 271
http://www.devitto.com                         mailto:dom@devitto.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 


-----Original Message-----
From: owner-misc@openbsd.org [mailto:owner-misc@openbsd.org] On Behalf
Of Henning Brauer
Sent: Tuesday, December 31, 2002 1:56 AM
To: misc@openbsd.org
Subject: Re: PF and stalled connections


On Mon, Dec 30, 2002 at 02:34:57PM -0800, David S. wrote:
> The OP's 'pf.conf' contained
> 
> 	# pass all packets
> 	pass in on $ext all keep state
> 	pass out on $ext all keep state
> 	pass in on $int all keep state
> 	pass out on $int all keep state
> 	---------------pf.conf----------------
> 
> Keeping state on everything could over-load the state table under 
> heavy traffic.

please stop spreading lies.