From owner-freebsd-questions@FreeBSD.ORG Tue Nov 28 20:35:12 2006 Return-Path: X-Original-To: questions@FreeBSD.org Delivered-To: freebsd-questions@FreeBSD.ORG Received: from mx1.FreeBSD.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 7FEBA16A4C2 for ; Tue, 28 Nov 2006 20:35:12 +0000 (UTC) (envelope-from cswiger@mac.com) Received: from smtpout.mac.com (smtpout.mac.com [17.250.248.177]) by mx1.FreeBSD.org (Postfix) with ESMTP id A8BB143CB3 for ; Tue, 28 Nov 2006 20:34:25 +0000 (GMT) (envelope-from cswiger@mac.com) Received: from mac.com (smtpin05-en2 [10.13.10.150]) by smtpout.mac.com (Xserve/8.12.11/smtpout07/MantshX 4.0) with ESMTP id kASKUprH006454; Tue, 28 Nov 2006 12:30:52 -0800 (PST) Received: from [17.214.13.96] (a17-214-13-96.apple.com [17.214.13.96]) (authenticated bits=0) by mac.com (Xserve/smtpin05/MantshX 4.0) with ESMTP id kASKUmiM009928; Tue, 28 Nov 2006 12:30:49 -0800 (PST) In-Reply-To: <378BFA1E1FEC59458FEB168D1B4BD0075C995A@excsvr003.scriptpro.com> References: <378BFA1E1FEC59458FEB168D1B4BD0075C995A@excsvr003.scriptpro.com> Mime-Version: 1.0 (Apple Message framework v752.2) Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed Message-Id: Content-Transfer-Encoding: 7bit From: Chuck Swiger Date: Tue, 28 Nov 2006 12:30:47 -0800 To: gschultz@scriptpro.com X-Mailer: Apple Mail (2.752.2) X-Brightmail-Tracker: AAAAAA== X-Brightmail-scanned: yes Cc: questions@FreeBSD.org Subject: Re: ping through ipfw giving unexpected results X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Nov 2006 20:35:12 -0000 On Nov 28, 2006, at 12:07 PM, gschultz@scriptpro.com wrote: > I tried this at plr's from 0.002 up to 0.47, and did the math: > ping is > failing exactly (allowing for statistical variation) 1.500 times more > than expected. This is too unlikely to be chance, so I figure the > nice > round fraction of additional failures is due to something I don't yet > understand. Can anyone explain this result? Thanks. Sounds like your rules are also being applied to the ICMP response, as well? If you have plr = .25, there's a .75 chance that the request will go through; if the request does go through, there will be a .75 chance that the reply will also get back, for a total .25 + .75 * .25 == . 4375 chance of no answer getting through...? -- -Chuck