On May 5, 2005, at 8:43 AM, Jonathan Camenisch wrote:
I will say one word in my own defense - even if it has no practical point (since I intend to try to do things in a standard "pf way"). It really seems less readable to me to mix quick and non-quick rules.
So don't... nobody's telling you to use quick.
When there's a mixture, you have to read and comprehend a non-linear sequence. But with the way that pf works, I wouldn't want to throw away quick altogether, just because I don't want pf reading the whole file for every packet (well, minus skipped rules).
It doesn't. PF uses a method called "skip steps" to only compare against rules that are relevant. Quit trying to over-engineer, PF is plenty fast enough. When you need to filter 10Gbps, come back to me and we'll hash it out.
-- Jason Dixon DixonGroup Consulting http://www.dixongroup.net
