[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pfctl, counters, labels, and a headache.
- To: misc_(_at_)_openbsd_(_dot_)_org
- Subject: Re: pfctl, counters, labels, and a headache.
- From: Ingo Miosga <ingo_(_dot_)_miosga_(_at_)_datafactory_(_dot_)_de>
- Date: Mon, 21 Feb 2005 17:16:01 +0100
> If this is the case, doesn't anybody count incoming and
> outgoing traffic on a protocol basis?
I really would like to know how others do ip accounting. Is anybody
using ipcad? Something else using bpf?
I dislike doing ip accounting with pf as this clutters my pf ruleset.
Suppose you have something like:
pass out on $if proto tcp from $host_a to $host_b port 80 keep state
Why would I extend this simple rule by at least one additional matching
'pass in' rule just for accounting? This adds complexity to the ruleset
without any additional gain of security, doesn't it? BTW, I did not
check the pf sources, but if the state is created by the outbound
traffic and used for inbound traffic, exactly when will the 'pass-in'
rule be counted?