> I think it is caused by the packets blocked having the RST flag set -- a > consequence of specifying "flags S/SA" in rule @39. Check out man > pf.conf. Look for section about "flags a/b | any" (line 317 here).
The S/SA wasn't set explicitly my me, its the default. Out of interest, would this possibly be a PF behaviour change somewhere between 6.1 and 6.3 ? I'm trying to troubleshoot a VoIP phone that has stopped functioning, and the only change has been an upgrade to 6.3.
