There is a wildly used example concerning PF and prioritising empty ACK packets, so that an an asynchronous connections' downstream does not lose performance, if the upstream is clogged up.
The example can be found in a variety of places, e.g.:
http://www.benzedrine.cx/ackpri.html
pass out on $ext_if proto tcp from $ext_if to any flags S/SA \
keep state queue (q_def, q_pri)
pass in on $ext_if proto tcp from any to $ext_if flags S/SA \
keep state queue (q_def, q_pri)
I do not understand why this rule works as it does:
The second queue parameter puts empty ACKs in the priority queue. That one I get. But the flag matching matches only if it's the first packet in the connection. From the pf.conf man page:
Because flags S/SA is applied by default (unless no state is
specified), only the initial SYN packet of a TCP handshake will
create a state for a TCP connection.
So, how does it affect empty ACKs? Not claiming everyone is doing it wrong, I'd just like to understand the mechanics.