Hello Hrvoje,
thanks for giving it a try.
On Fri, Jun 26, 2026 at 05:03:44PM +0200, Hrvoje Popovski wrote:
</snip>
> Counters
> match 851940 41.9/s
> bad-offset 0 0.0/s
> fragment 0 0.0/s
> short 25 0.0/s
> normalize 5 0.0/s
> memory 0 0.0/s
> bad-timestamp 0 0.0/s
> congestion 0 0.0/s
> ip-option 210 0.0/s
> proto-cksum 0 0.0/s
> state-mismatch 842 0.0/s
> state-insert 0 0.0/s
> state-limit 0 0.0/s
> src-limit 0 0.0/s
> synproxy 0 0.0/s
> translate 0 0.0/s
> no-route 0 0.0/s
> ID USE/LIMIT RATE/SECS ADMIT HARDLIM RATELIM
> ID USE/ADDRS LIMIT RATE/SECS ADMIT ADDRLIM HARDLIM RATELIM
>
this is the new thing in 7.9, these are the new limiters
from David Gwynne. it's landed in Nov 2025. The older firewalls
7.8 and earlier don't have this feature.
may be pfctl should be print these if they are not defined. Let's
defer it to another commit.
> TIMEOUTS:
> tcp.first 120s
> tcp.opening 30s
> tcp.established 86400s
>
I believe the end of the output shows something like this now:
OS FINGERPRINTS:
714 fingerprints loaded
thanks and
regards
sashan
