altq for vlans?

[Max Laier]

On Monday 14 February 2005 10:43, Jeremie Le Hen wrote:
> > Anyways, the _real_ problem is that traditionally, I'd used firewall
> > rules for accounting as well as security.  To that end, labels are
> > very cool.  However, they have one rather large defect:
> >
> > If you're dealing with keep state rules, there seems to be no obvious
> > way to account for incoming vs. outgoing traffic.  The label only
> > reports total traffic for the state matching the rule... which is both
> > in and out.
>
> This is a workaround, but I found that ipfw's count rules are pretty
> useful for this purpose.  This would however add processing overhead
> for each packet especially using gigabit Ethernet.

Did you try to use tables?  I think it's one of the best tools for easy 
accounting.

$pfctl -vvT show -t test
   192.168.0.1
        Cleared:     Mon Feb 14 14:19:39 2005
        In/Block:    [ Packets: 0                  Bytes: 0                  ]
        In/Pass:     [ Packets: 2                  Bytes: 168                ]
        Out/Block:   [ Packets: 0                  Bytes: 0                  ]
        Out/Pass:    [ Packets: 2                  Bytes: 168                ]

It does count everything on stateful rules and it's easy to monitor subnets 
and whatnot.  See the various manual pages and the OpenBSD FAQ for more about 
tables.  You might also want to have a look at pfflowd from ports, which is 
able to translate pfsync messages into flows for accounting purposes.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20050214/f603739e/attachment.bin