On Monday 14 February 2005 10:43, Jeremie Le Hen wrote: > > Anyways, the _real_ problem is that traditionally, I'd used firewall > > rules for accounting as well as security. To that end, labels are > > very cool. However, they have one rather large defect: > > > > If you're dealing with keep state rules, there seems to be no obvious > > way to account for incoming vs. outgoing traffic. The label only > > reports total traffic for the state matching the rule... which is both > > in and out. > > This is a workaround, but I found that ipfw's count rules are pretty > useful for this purpose. This would however add processing overhead > for each packet especially using gigabit Ethernet.
Did you try to use tables? I think it's one of the best tools for easy
accounting.
$pfctl -vvT show -t test
192.168.0.1
Cleared: Mon Feb 14 14:19:39 2005
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 2 Bytes: 168 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 2 Bytes: 168 ]
It does count everything on stateful rules and it's easy to monitor subnets
and whatnot. See the various manual pages and the OpenBSD FAQ for more about
tables. You might also want to have a look at pfflowd from ports, which is
able to translate pfsync messages into flows for accounting purposes.
--
/"\ Best regards, | [EMAIL PROTECTED]
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | [EMAIL PROTECTED]
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
pgpk110QOhPW3.pgp
Description: PGP signature
