OpenBSD's pf and traffic

[Peter N. M. Hansteen]

"Eugene M. Minkovskii" <emin at mccme.ru> writes:

> Unfortunely, this mean, that OpenBSD's pf can not measure
> traffic, because we can not separate incoming and outgoing
> traffic in bidirectional rule. Or we must not use keep state
> feature.

I think I understand what you mean - you do not want per connection
statistics, you want packets passed by direction, regardless of which
side initiated the traffic, subdivided by pass rule. At the moment I'm
not sure how to put that into pf.conf rules, but you may want to go
where the real pf experts hang out - pf at benzedrine.cx - and see if
there's an angle we haven't thought of.

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/
"First, we kill all the spammers" The Usenet Bard, "Twice-forwarded tales"