dummynet dropping too many packets

[Julian Elischer]

Oleg Bulyzhin wrote:
> On Wed, Oct 07, 2009 at 09:42:27PM +0500, rihad wrote:
>> Julian Elischer wrote:
>>> rihad wrote:
>>>> Oleg Bulyzhin wrote:
>>>> You probably have some special sources of documentation ;-) According 
>>>> to man ipfw, both "netgraph/ngtee" and "pipe" decide the fate of the 
>>>> packet unless one_pass=0. Or do you mean sprinkling smart skiptos here 
>>>> and there? ;-)
>>>>
>>> ngtee should not have any affect on the packet.. it takes a copy..
>>>
>> That's a logical conclusion, although I prefer trusting the man at hand 
>> (pun intended) if I haven't tested it myself to see how it works:
>>
>>       ngtee cookie
>>               A copy of packet is diverted into netgraph, original packet is
>>               either accepted or continues with the next rule, depending on
>>               net.inet.ip.fw.one_pass sysctl variable.  See ng_ipfw(4) 
>> for more
>>               information on netgraph and ngtee actions.
>>
>>
>> Although... I've a question to Mr. Oleg:
>>
>>> 2) use 'tee' rule with ng_ksocket & ng_netflow
>>       tee port
>>               Send a copy of packets matching this rule to the divert(4) 
>> socket
>>               bound to port port.  The search continues with the next rule.
>>
>> how is it different from one_pass=0? Both tee and ngtee w/ one_pass=0 
>> continue with the next rule.
> 
> tee & ngtee are similar with one_pass=0 and different with one_pass=1

that seems like a bug to me..
neither tee should ever terminate a search.

if you want to terminate it, add a specific rule to do so.
Unfortunately I wasn't involved in writing it.