0

There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up.

The example can be found in a variety of places, e.g.:

http://www.benzedrine.cx/ackpri.html

pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
        keep state queue (q_def, q_pri)

pass in  on $ext_if proto tcp from any to $ext_if flags S/SA \
        keep state queue (q_def, q_pri)

I do not understand why this rule works as it does:

The second queue parameter puts empty ACKs in the priority queue. That one I get. But the flag matching matches only if it's the first packet in the connection. From the pf.conf man page:

Because flags S/SA is applied by default (unless no state is
specified), only the initial SYN packet of a TCP handshake will
create a state for a TCP connection.

So, how does it affect empty ACKs? Not claiming everyone is doing it wrong, I'd just like to understand the mechanics.

1 Answer 1

0

On PF when you set keep state, you will create a state for stateful tracking, so you won't need to allow other packets related to this connection afterwards.

Also, when you set queue, it will be applied on all packets related to this connection, when you set the second queue parameter, it will make all packets that have ToS low-delay set or ACK packets with no payload be associated with the second queue and not the first one.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .