using pfctl -s labels and keep state for traffic accounting

[Roman Bogorodskiy]

Hi,

I'm going to use pf's label feature for traffic accounting, i.e.
creating an anchor for being able to add/remove rules with labels
on fly and parse the output of pfctl -s labels.

However, I spotted some problems with such an approach. When using 'keep
state' it seems to have some limitations. First of all, it doesn't seem
to allow to account in only one direction. Well, it was expected because
states works that way.

But calculating traffic in both directions give stange resuls too.

I have a rule:

pass log quick on $ext_if proto tcp from self to some_host port
https label "labels:test",

I have a file on https which I download.

After first try it gives: 

labels:test 284 23 2943

Then I add 'keep state', reload the rules file, check if the counters
are zeroed and download the same file again and get:

labels:test 3 46 29427

Why does it happen that way?

BTW, is there some other limitations to the approach of traffic
accounting based on pf labels?

Roman Bogorodskiy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 305 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20070704/ed6f121a/attachment.pgp