It surely has its caveats, but has its use, too. I'm stuck with ipfw on
one last machine, because I can't limit bulk TCP traffic with pf. Of
course, downstream limiting will never throttle DoS attacks, ICMP or
'dumb' UDP traffic with no acknowledgements, but works just fine for
everything else. Even on ipfw's contemptible 'dummynet'.

| If you want to do this with ALTQ, you can do so by limiting outgoing
| packets on the "other" interface, assuming the box is forwarding all
| packets between two interfaces.

I can speak for myself - I can't afford both the hardware and the
electricity bill for a separate machine. Maybe downstream limiting isn't
very robust, but IMO is the biggest thing pf/altq lacks.

-- sh

application_pgp-signature_part < 1K Download