Re: pf fragment drop stale

2017-06-26 Thread Alexandr Nedvedicky
Hello, On Mon, Jun 26, 2017 at 05:51:08PM +0200, Alexander Bluhm wrote: > On Mon, Jun 26, 2017 at 10:29:24AM +0200, Alexandr Nedvedicky wrote: > > > +#define PF_FRAG_STALE200 /* Limit fragments per second per > > > connection */ > > > I did not get how we arrived to 'Limit fragments

Re: pf fragment drop stale

2017-06-26 Thread Alexander Bluhm
On Mon, Jun 26, 2017 at 10:29:24AM +0200, Alexandr Nedvedicky wrote: > > +#define PF_FRAG_STALE 200 /* Limit fragments per second per > > connection */ > I did not get how we arrived to 'Limit fragments per second per > connection.' Actually I was looking at markus@'s algorithm and

Re: pf fragment drop stale

2017-06-26 Thread Alexandr Nedvedicky
Hello, looks good to me, though I still need better explanation for PF_FRAG_STALE. The current comment seems bit misleading to me. > #define PFTM_TS_DIFF_VAL 30 /* Allowed TS diff */ > > +#define PF_FRAG_STALE200 /* Limit fragments per second per > connection */

Re: pf fragment drop stale

2017-06-25 Thread Alexander Bluhm
On Fri, Jun 23, 2017 at 03:00:07PM +0200, Alexander Bluhm wrote: > Adjusted timeouts will follow in the next diff. To avoid that fragments for a single connection that reuse the fragment id are reassembled into the wrong packet, throw away stale fragments. With the default timeout this happens af