From owner-freebsd-pf@freebsd.org Mon Jun 29 10:58:37 2015 Return-Path: Delivered-To: freebsd-pf@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 9E9FD98F626 for ; Mon, 29 Jun 2015 10:58:37 +0000 (UTC) (envelope-from ian.freislich@capeaugusta.com) Received: from mail-wi0-f178.google.com (mail-wi0-f178.google.com [209.85.212.178]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 569131180 for ; Mon, 29 Jun 2015 10:58:37 +0000 (UTC) (envelope-from ian.freislich@capeaugusta.com) Received: by wiwl6 with SMTP id l6so95708808wiw.0 for ; Mon, 29 Jun 2015 03:58:35 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references :mime-version:content-type:content-id:date:message-id; bh=9TkfxpxB5K/cbCucygS8m3TAtorCgsXzOb8FL/nvcHI=; b=SXwlAUl3CT6Q4mByqfl1I1DR477+GIJoAIFcM00EuNWKx8pVUWMyc7rA19KYMuw/vL //Y4OmyP1/Di9SMAoQ5LnlEbsuxzbt1MIknKembqnygvG4f5xud37OrlKc6rVTiYG/mm qUiNiSB8QGJRtDP56o2HlwUBjfUs1p3Hl5o8Qz8iKSNtjccIsXvNxHlgtKAOe6cmYsTX t5lX2mQowQORmjdnV5TD8h2M4V983b+yjjNS6fWwQ7pX3SAEcLulRiEB4PG2SIgZepI0 QRQJgU2JT8uNxzH6/EVEt7LvnCjw4r9GPjwtXlzG+g1Q/FWJxGS7iXzpeRHzg4XtkzNa TQ+Q== X-Gm-Message-State: ALoCoQm3Ewo5rZfIP6FSgk24aXb6uYEmvIdhlyvcBxdCRjL663bctXJAUa9cP59F1tE7EvM4bUnU X-Received: by 10.180.105.227 with SMTP id gp3mr21692311wib.56.1435575515718; Mon, 29 Jun 2015 03:58:35 -0700 (PDT) Received: from clue.co.za ([197.89.34.55]) by mx.google.com with ESMTPSA id gw7sm11595024wib.15.2015.06.29.03.58.34 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 29 Jun 2015 03:58:34 -0700 (PDT) From: Ian FREISLICH X-Google-Original-From: Ian FREISLICH Received: from localhost ([127.0.0.1] helo=zen) by clue.co.za with esmtp (Exim 4.85 (FreeBSD)) (envelope-from ) id 1Z9Wlk-00003g-0l; Mon, 29 Jun 2015 12:58:32 +0200 To: Milan Obuch cc: Daniel Hartmeier , freebsd-pf@freebsd.org Subject: Re: Large scale NAT with PF - some weird problem In-Reply-To: <20150629125432.7aff9e66@zeta.dino.sk> References: <20150629125432.7aff9e66@zeta.dino.sk> <20150629114506.1cfd6f1b@zeta.dino.sk> <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com> <20150621195753.7b162633@zeta.dino.sk> <20150623112331.668395d1@zeta.dino.sk> <20150628100609.635544e0@zeta.dino.sk> <20150629082654.GA22693@insomnia.benzedrine.ch> <20150629105201.7ee24e38@zeta.dino.sk> <20150629092932.GC22693@insomnia.benzedrine.ch> X-Attribution: BOFH MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <226.1435575512.1@zen> Date: Mon, 29 Jun 2015 12:58:32 +0200 Message-Id: X-BeenThere: freebsd-pf@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Technical discussion and general questions about packet filter \(pf\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Jun 2015 10:58:37 -0000 Milan Obuch wrote: > > No, there were not much states per problematic IP, maybe just tens of > them for one or couple internal IPs. That's weird. What's the output of 'pfctl -sa' (without the states). Ian -- Ian Freislich