On Thu, Sep 23, 2004 at 01:36:57PM +0545, Bikrant Neupane wrote: > Thanks for the reply. > Well I am not looking for the count rule. > > Actually I have some other situation. I am trying to implement b/w shaping > using ipfw. And i am trying to include mac address based filtering in it as > well. As long as I don't implement ipfw in ether (net.link.ether.ipfw=0/1) > pkts hit the rule only once and I get the b/w as specified in the IPFW pipe > syntax. However when I enable ipfw in ether all the pkts hits the matching > rule twice. and as a result I get half of the b/w to what has been specified > in ipfw pipe. > This is normal (as mentiontioned in ipfw man page) since pkt traversal is > doubled when IPFW is enabed in ether. > <snip>
Would the following sysctl variable help your problem?
From the ipfw manpage:
net.inet.ip.fw.one_pass: 1
When set, the packet exiting from the dummynet(4) pipe is not passed
though the firewall again. Otherwise, after a pipe action, the packet
is reinjected into the firewall at the next rule.
Nathan
--
PGP Public Key: pgp.mit.edu:11371/pks/lookup?op=get&search=0xD8527E49
pgppL8PKhEk3n.pgp
Description: PGP signature
