Hello, I'm in period of an internship, and I will use OpenBSD in my task. Actually I have a problem concerning pf. the issue is to count volume of packets belonging to a session and a session is defined as the following :*"@source, @dest, Port source, Port dest, and protocole used TCP/UDP/ICMP"* So the issue is when a volume of a session exceeds a threshold this session I want to put it in another queue with less priority.
Creating queues is simple using altq/queue/HCSF for example. My problem is how can I in real time detect that this session had exceeded a threshold and how I can redirect the packets of this session to a less prioritized queue. For instance I don't think that could be done in userspace!! I think I have to deal whith the kernel space. So I fetched in the kernel and I found pf.c file that I suppose would be the key file for my internship !!! I found the function : pf_test() in sys/net/pf.c , and I *think* the line : s->bytes[dirndx] += pd.tot_len would count bytes used by a *session* as I ALREADY DEFINED above. I really need to know know if this is true or false ?? Because I think if I make conditions on that line to fix the threshold I think the problem is solved and then I can redirect packets of this session to another queue !!! I'm new in the field and I really need support because there is not so much documentation on that topic and few people who really master pf implementation. Can you help me please ? Any idea or comment will be welcome ... Best regards, Ali Gouta.
