Re: PF and stalled connections

[Henning Brauer <lists-openbsd@bsws.de>]

On Wed, Jan 01, 2003 at 09:04:02PM -0000, Dom De Vitto wrote:
> I think Henning means:
> The state table grows/shrinks appropriately.

yes. to exhaust the state table (which in theory is possible) without
setting a very low limit you'd have to have a _lot_ of connections.

> So (unlike other firewalls) you NEVER "run out" until you run out of
> RAM (and maybe not even then - is the area swappable? Is any part of
> the Obsd kernel swappable?)

well we acquire memory via pool(9), that is not swappable.