Re: Understanding pf statistics

On Tue, 26 Apr 2022 23:23:43 -0700
Clint Pachl <pachl@ecentryx.com> wrote:

> In the following command, is "Packets" the number of dropped packets
> after 5,435,315 evaluations of that block rule?
>
> If so, is "Bytes" the total size of those 16,303 dropped packets?
>
> And is "States" zero because it is a block rule, thus no state
> created?
>
> # pfctl -s rules -vR11
> block drop in log quick on egress from <bad_smtp_hosts> to any
> [Evaluations: 5435315 Packets: 16303 Bytes: 943433 States: 0]
> [Inserted: uid 0 pid 86885 State Creations: 0]

That is how I interpret those numbers.

--
Before enlightenment - chop wood, draw water.
After enlightenment - chop wood, draw water.

Marko Cupać
https://www.mimar.rs/