Page MenuHomeFreeBSD

pf: add a generic packet rate matching filter
ClosedPublic

Authored by kp on Jun 11 2025, 7:40 PM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Oct 14, 5:31 AM
Unknown Object (File)
Fri, Oct 10, 11:12 PM
Unknown Object (File)
Thu, Sep 18, 10:17 AM
Unknown Object (File)
Sep 11 2025, 3:16 PM
Unknown Object (File)
Sep 9 2025, 9:36 AM
Unknown Object (File)
Sep 7 2025, 6:33 PM
Unknown Object (File)
Sep 4 2025, 4:03 AM
Unknown Object (File)
Sep 3 2025, 4:49 PM

Details

Summary

allows things like
pass in proto icmp max-pkt-rate 100/10
all packets matching the rule in the direction the state was created are
taken into consideration (typically: requests, but not replies).
Just like with the other max-*, the rule stops matching if the maximum is
reached, so in typical scenarios the default block rule would kick in then.
with input from Holger Mikolon
ok mikeb

Obtained from: OpenBSD, henning <henning@openbsd.org>, 5a4ae9a9cb
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable