David Gwynne (dlg@) has
introduced
source and state limiters,
which provide a massive increase in the flexibily
of pf traffic limiting:
CVSROOT: /cvs Module name: src Changes by: dlg@cvs.openbsd.org 2025/11/10 21:06:20 Modified files: sbin/pfctl : parse.y pfctl.8 pfctl.c pfctl_parser.c pfctl_parser.h share/man/man5 : pf.conf.5 sys/net : pf.c pf_ioctl.c pf_table.c pfvar.h pfvar_priv.h Log message: introduce source and state limiters in pf. both source and state limiters can provide constraints on the number of states that a set of rules can create, and optionally the rate at which they are created. state limiters have a single limit, but source limiters apply limits against a source address (or network). the source address entries are dynamically created and destroyed, and are also limited.