Date: Mon, 26 Feb 2007 13:40:11 +0000 From: RW <fbsd06@mlists.homeunix.com> To: freebsd-questions@freebsd.org Subject: Re: pf and keep/modulate state on 6.2 Message-ID: <20070226134011.6a676af7@gumby.homeunix.com> In-Reply-To: <200702261159.l1QBx46X006755@cheyenne.sixcompanies.com> References: <200702252202.l1PM2r46003312@cheyenne.sixcompanies.com> <720051dc0702260052v8e4d2b2v9bbca164bfe87a4b@mail.gmail.com> <200702261159.l1QBx46X006755@cheyenne.sixcompanies.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Mon, 26 Feb 2007 05:59:58 -0600 "J.D. Bronson" <jbronson@wixb.com> wrote: > At 02:52 AM 02/26/2007, you wrote: > >Wow, this fixed my FTP-over-DSL-to-6.2 problem too. With modulate > >state, I was getting ~30K/sec. With just keep state, I'm now getting > >more like what my connection is capable of. This is between two 6.2 > >hosts on opposite sides of the Atlantic. > > > >Ted, I use pf because I like the format of the configuration file, I > >like the logging and pftop, and like how it's harder to lock yourself > >out of a remote machine by accident :) > > > >/JMS > > I use pf since its newer (I think?) and I came from openbsd..pf just > works and the config file is nice and sweet. > > I had thought that modulate state would put a load on my proc, but > sheesh, its a p4-3.06 - thats more than robust for a router. > > I wonder if we should file a bug on this? > > I am glad my post helped here. I still use modulate state for any > INCOMING connections though (www/smtp/etc). I wonder how much point there is in using "modulate" these days. The ISN vulnerabilties it protects against were fixed a long time ago - we're talking about unpatched Windows NT/9X machines and the like.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070226134011.6a676af7>