From owner-freebsd-questions@FreeBSD.ORG Mon Feb 26 13:40:19 2007 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 9ED3016A403 for ; Mon, 26 Feb 2007 13:40:19 +0000 (UTC) (envelope-from fbsd06@mlists.homeunix.com) Received: from mxout-03.mxes.net (mxout-03.mxes.net [216.86.168.178]) by mx1.freebsd.org (Postfix) with ESMTP id 78F0413C4AA for ; Mon, 26 Feb 2007 13:40:15 +0000 (UTC) (envelope-from fbsd06@mlists.homeunix.com) Received: from gumby.homeunix.com (unknown [87.81.140.128]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.mxes.net (Postfix) with ESMTP id 31BE451983 for ; Mon, 26 Feb 2007 08:40:13 -0500 (EST) Date: Mon, 26 Feb 2007 13:40:11 +0000 From: RW To: freebsd-questions@freebsd.org Message-ID: <20070226134011.6a676af7@gumby.homeunix.com> In-Reply-To: <200702261159.l1QBx46X006755@cheyenne.sixcompanies.com> References: <200702252202.l1PM2r46003312@cheyenne.sixcompanies.com> <720051dc0702260052v8e4d2b2v9bbca164bfe87a4b@mail.gmail.com> <200702261159.l1QBx46X006755@cheyenne.sixcompanies.com> X-Mailer: Claws Mail 2.7.2 (GTK+ 2.10.9; i386-portbld-freebsd6.2) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: pf and keep/modulate state on 6.2 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 26 Feb 2007 13:40:19 -0000 On Mon, 26 Feb 2007 05:59:58 -0600 "J.D. Bronson" wrote: > At 02:52 AM 02/26/2007, you wrote: > >Wow, this fixed my FTP-over-DSL-to-6.2 problem too. With modulate > >state, I was getting ~30K/sec. With just keep state, I'm now getting > >more like what my connection is capable of. This is between two 6.2 > >hosts on opposite sides of the Atlantic. > > > >Ted, I use pf because I like the format of the configuration file, I > >like the logging and pftop, and like how it's harder to lock yourself > >out of a remote machine by accident :) > > > >/JMS > > I use pf since its newer (I think?) and I came from openbsd..pf just > works and the config file is nice and sweet. > > I had thought that modulate state would put a load on my proc, but > sheesh, its a p4-3.06 - thats more than robust for a router. > > I wonder if we should file a bug on this? > > I am glad my post helped here. I still use modulate state for any > INCOMING connections though (www/smtp/etc). I wonder how much point there is in using "modulate" these days. The ISN vulnerabilties it protects against were fixed a long time ago - we're talking about unpatched Windows NT/9X machines and the like.