understanding PF src-limit counter

2008-03-24 Thread Jose Fragoso
Hi, I searched the FAQ and the man pages (for pf, pf.conf and pfctl.conf), but I did not find a definition for the src-limit counter which is showed by the command pfctl -si. With pfctl -sa I saw this: LIMITS: stateshard limit 20 src-nodes hard limit1 frags

Re: understanding PF src-limit counter

2008-03-24 Thread Calomel
Jose, The 'src-limit' counter advances by one for every packet blocked by a rate limited rule. If you write a pf rule using stateful tracking options to allow connections at a rate of 20 per 60 seconds then packets arriving faster than this would be blocked. You could then look at the 'src-limit'