*BSD News Article 53971


Return to BSD News archive

Newsgroups: comp.unix.bsd.freebsd.misc
Path: euryale.cc.adfa.oz.au!newshost.anu.edu.au!harbinger.cc.monash.edu.au!news.rmit.EDU.AU!news.unimelb.EDU.AU!cs.mu.OZ.AU!rdsgc
From: rdsgc@cs.mu.OZ.AU (Gavin CAMERON)
Subject: Question about IP accounting
Message-ID: <9531016.6997@mulga.cs.mu.OZ.AU>
Organization: Computer Science, University of Melbourne, Australia
Date: Mon, 6 Nov 1995 05:11:53 GMT
Lines: 25

I have a question about IP accounting in the 2.0.5 FreeBSD kernel.

I setup my accounting chain in the following way:
	ipfw adda single all from hostA to hostB via ppp0
	ipfw adda single all from 0.0.0.0/0 to hostB via ppp0

What I want to be able to do is account for all traffic that IS NOT
coming from hostA. Logically, the second rule should catch this.

Here's my question. In FreeBSD once a packet matches one accounting
rule is it matched against any other accounting rules?

If it is, should it be? I say no. But there many be a very compelling
reason why it is.

It appears to me that the counters are updated for every accounting
rule that the packet matches. So in the above example a packet coming
from hostA will be caught by both rules, and we get double
accounting for the packet.

I can write scripts to get around the problem, but the implementation
seems flawed.

Gavin
gavin@ormond.unimelb.edu.au