Page MenuHomeFreeBSD

pf: add a generic packet rate matching filter
ClosedPublic

Authored by kp on Jun 11 2025, 7:40 PM.
Tags
None
Referenced Files
Unknown Object (File)
Wed, Dec 10, 7:53 AM
Unknown Object (File)
Sun, Dec 7, 5:59 PM
Unknown Object (File)
Sat, Dec 6, 11:58 AM
Unknown Object (File)
Fri, Dec 5, 7:56 PM
Unknown Object (File)
Sun, Nov 30, 5:13 PM
Unknown Object (File)
Sat, Nov 29, 3:34 AM
Unknown Object (File)
Fri, Nov 28, 5:12 AM
Unknown Object (File)
Sun, Nov 23, 3:38 PM

Details

Summary

allows things like
pass in proto icmp max-pkt-rate 100/10
all packets matching the rule in the direction the state was created are
taken into consideration (typically: requests, but not replies).
Just like with the other max-*, the rule stops matching if the maximum is
reached, so in typical scenarios the default block rule would kick in then.
with input from Holger Mikolon
ok mikeb

Obtained from: OpenBSD, henning <henning@openbsd.org>, 5a4ae9a9cb
Sponsored by: Rubicon Communications, LLC ("Netgate")

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 64766
Build 61650: arc lint + arc unit