Re: keep state and PF Queues

2005-10-21 Thread Brian A. Seklecki
I was just curious if any of the developers (or experts) would care to articulate officially :} ~BAS On Wed, 19 Oct 2005, William Bloom wrote: The PF queueing FAQ page at http://www.openbsd.org has a wealth of info that seems to nicely clarify the pf.conf man page. I recall that the FAQ

Re: keep state and PF Queues

2005-10-21 Thread Henning Brauer
well, I did numerous times in the past. th emisunderstanding most of you have is that queue assignment and th actual queueing are sepearate things. you assign a queue with the name X somewhere, be it by a rule in the inbound path or the outbound, or a state in either direction, and when we hit

Re: keep state and PF Queues

2005-10-21 Thread Brian A. Seklecki
If a TCP flow is egressing an interface at 2000k/s (17-18mbps), it might be causing as much as 300kbps of ACK traffic. That traffic really doesn't get queued on return at the same inteface it's egressing. However, I have noticed that, if a traffic flow is passing through a router (say, the

keep state and PF Queues

2005-10-19 Thread Brian A. Seklecki
Would anyone like to elaborate on the impacts of using keep state on conjunction with pass rules that assign traffic to queues? One might assume that inverted traffic flows would also be queued, however that would break the traffic can only be queued egress an interface rule... There should

Re: keep state and PF Queues

2005-10-19 Thread William Bloom
The PF queueing FAQ page at http://www.openbsd.org has a wealth of info that seems to nicely clarify the pf.conf man page. I recall that the FAQ contains an example much as you describe (as I recall, specifying a queue for -incoming- traffic will indeed cause that traffic to be processed