> This is cosmetics. However, whouldn't we get some performance increase > if pf(4) didn't bother looking at packets (in certain situations) going > 'out' at all? > > I assume that 'pass out all keep state' makes pf(4), at least, do a > state lookup in the table? AFAIK, that's, in worst case scenario, 16 > searches down the binary tree? That ought to eat a few cycles.
In the immortal words of Donald Knuth: "We should forget about small efficiencies ... premature optimization is the root of all evil" I really doubt there is a performance issue here, or really, that this would be the bottleneck. If it is, show the facts, and we (I use the royal we here, meaning Daniel or Henning) can address it then. Out. -kj
