This `not not' is confusing a bit. (I want to match all packets smaller than 300 or greater than 500 bytes.) 4.9-STABLE, IPFW2: % ipfw add 3 count ip from any to any not iplen 300-500 00003 count ip from any to any not not iplen 300-500 % ipfw show 3 00003 3181 1729676 count ip from any to any not not iplen 300-500 -- Paweł Małachowski