Date: Mon, 14 Feb 2005 14:25:53 +0100 From: Max Laier <max@love2party.net> To: freebsd-net@freebsd.org Cc: David Gilbert <dgilbert@dclg.ca> Subject: Re: altq for vlans? Message-ID: <200502141426.01067.max@love2party.net> In-Reply-To: <20050214094353.GX82324@obiwan.tataz.chchile.org> References: <16911.51264.86063.604597@canoe.dclg.ca> <16912.11613.216501.589279@canoe.dclg.ca> <20050214094353.GX82324@obiwan.tataz.chchile.org>
next in thread | previous in thread | raw e-mail | index | archive | help
--nextPart1483631.nVka8C0Pax
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
On Monday 14 February 2005 10:43, Jeremie Le Hen wrote:
> > Anyways, the _real_ problem is that traditionally, I'd used firewall
> > rules for accounting as well as security. To that end, labels are
> > very cool. However, they have one rather large defect:
> >
> > If you're dealing with keep state rules, there seems to be no obvious
> > way to account for incoming vs. outgoing traffic. The label only
> > reports total traffic for the state matching the rule... which is both
> > in and out.
>
> This is a workaround, but I found that ipfw's count rules are pretty
> useful for this purpose. This would however add processing overhead
> for each packet especially using gigabit Ethernet.
Did you try to use tables? I think it's one of the best tools for easy=20
accounting.
$pfctl -vvT show -t test
192.168.0.1
Cleared: Mon Feb 14 14:19:39 2005
In/Block: [ Packets: 0 Bytes: 0 =
]
In/Pass: [ Packets: 2 Bytes: 168 =
]
Out/Block: [ Packets: 0 Bytes: 0 =
]
Out/Pass: [ Packets: 2 Bytes: 168 =
]
It does count everything on stateful rules and it's easy to monitor subnets=
=20
and whatnot. See the various manual pages and the OpenBSD FAQ for more abo=
ut=20
tables. You might also want to have a look at pfflowd from ports, which is=
=20
able to translate pfsync messages into flows for accounting purposes.
=2D-=20
/"\ Best regards, | mlaier@freebsd.org
\ / Max Laier | ICQ #67774661
X http://pf4freebsd.love2party.net/ | mlaier@EFnet
/ \ ASCII Ribbon Campaign | Against HTML Mail and News
--nextPart1483631.nVka8C0Pax
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (FreeBSD)
iD8DBQBCEKboXyyEoT62BG0RAtWoAJ9OJNvv7B51jcdZrY2glS8OHsuQmACfQ1EL
TOOcX6N2znncsgg5GpXdKII=
=Ecbd
-----END PGP SIGNATURE-----
--nextPart1483631.nVka8C0Pax--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200502141426.01067.max>