pfsync broadcasts without explicitly enabling it

[Peter Schuller]

Alright,

I have seen this on two machines now. At first I ignored it, but now I am 
wondering. Suddently I will spot an extraordinary amount of network traffic 
and on tcpdump:ing discover my machine is spewing out pfsync broadcasts.

On both machines pfsync was NOT enabled, nor had it ever been. pf_enable="YES" 
and pf_log="YES" was in rc.conf, but nothing about pfsync.

I can squish the broadcasts easily enough with 'ifconfig pfsync0 -syncdev 
down', but I am somewhat concerned over it being mysteriously enabled.

One of these machines is a 6.1, the other a 6.0 (though it may have been a 5.x 
at the time it happened, not sure). pf is being used actively without 
any 'no-sync' options present; but it is my understanding that no pfsync 
traffic should be generated until pfsync is explicitly turned on with 
ifconfig.

Does anyone have an explanation for this? I am quite sure I have never enabled 
pfsync in rc.conf, nor have I ever ran any ifconfig commands that might 
enable it. I am not running any kind of meta-firewall scripts or anything 
like that; there should be nothing but the standard FreeBSD rc scripts 
modifying network interfaces with ifconfig.

The second machine I saw this on has only been running for a few days, so I am 
even more sure I haven't done so on this one than on the other one.

-- 
/ Peter Schuller, InfiDyne Technologies HB

PGP userID: 0xE9758B7D or 'Peter Schuller <peter.schuller at infidyne.com>'
Key retrieval: Send an E-Mail to getpgpkey at scode.org
E-Mail: peter.schuller at infidyne.com Web: http://www.scode.org