Hi, I'm going to use pf's label feature for traffic accounting, i.e. creating an anchor for being able to add/remove rules with labels on fly and parse the output of pfctl -s labels.
However, I spotted some problems with such an approach. When using 'keep state' it seems to have some limitations. First of all, it doesn't seem to allow to account in only one direction. Well, it was expected because states works that way. But calculating traffic in both directions give stange resuls too. I have a rule: pass log quick on $ext_if proto tcp from self to some_host port https label "labels:test", I have a file on https which I download. After first try it gives: labels:test 284 23 2943 Then I add 'keep state', reload the rules file, check if the counters are zeroed and download the same file again and get: labels:test 3 46 29427 Why does it happen that way? BTW, is there some other limitations to the approach of traffic accounting based on pf labels? Roman Bogorodskiy
pgpWAzZCzRCR6.pgp
Description: PGP signature
