Specify the
command (may be abbreviated) to apply to the table. Commands include:
-T flush
Flush all addresses of a table.
-T add
Add one or more addresses in a table. Automatically create a nonexisting table.
-T delete
Delete one or more addresses from a table.
-T expire number
Delete addresses which had their statistics cleared more than number seconds ago. For entries which have never had their statistics cleared, number refers to the time they were added to the table.
-T replace
Replace the addresses of the table. Automatically create a nonexisting table.
-T show
Show the content (addresses) of a table.
-T test
Test if the given addresses match a table.
-T zero
Clear all the statistics of a table.
-T load
Load only the table definitions from
pf.conf(5). This is used in conjunction with the
-f flag, as in:
For the
add,
delete,
replace, and
test commands, the list of addresses can be specified either directly on the command line and/or in an unformatted text file, using the
-f flag. Comments starting with a ‘#' are allowed in the text file. With these commands, the
-v flag can also be used once or twice, in which case
pfctl will print the detailed result of the operation for each individual address, prefixed by one of the following letters:
A
The address/network has been added.
C
The address/network has been changed (negated).
D
The address/network has been deleted.
M
The address matches (test operation only).
X
The address/network is duplicated and therefore ignored.
Y
The address/network cannot be added/deleted due to conflicting ‘!' attributes.
Z
The address/network has been cleared (statistics).
Each table maintains a set of counters that can be retrieved using the
-v flag of
pfctl. For example, the following commands define a wide open firewall which will keep track of packets going to or coming from the
OpenBSD FTP server. The following commands configure the firewall and send 10 pings to the FTP server:
# printf "table <test> { ftp.NetBSD.org }\n \
pass out to <test>\n" | pfctl -f-
# ping -qc10 ftp.NetBSD.org
We can now use the table
show command to output, for each address and packet direction, the number of packets and bytes that are being passed or blocked by rules referencing the table. The time at which the current accounting started is also shown with the “Cleared” line.
# pfctl -t test -vTshow
129.128.5.191
Cleared: Thu Feb 13 18:55:18 2003
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 10 Bytes: 840 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 10 Bytes: 840 ]
Similarly, it is possible to view global information about the tables by using the
-v modifier twice and the
-s Tables command. This will display the number of addresses on each table, the number of rules which reference the table, and the global packet statistics for the whole table:
# pfctl -vvsTables
--a-r- test
Addresses: 1
Cleared: Thu Feb 13 18:55:18 2003
References: [ Anchors: 0 Rules: 1 ]
Evaluations: [ NoMatch: 3496 Match: 1 ]
In/Block: [ Packets: 0 Bytes: 0 ]
In/Pass: [ Packets: 10 Bytes: 840 ]
In/XPass: [ Packets: 0 Bytes: 0 ]
Out/Block: [ Packets: 0 Bytes: 0 ]
Out/Pass: [ Packets: 10 Bytes: 840 ]
Out/XPass: [ Packets: 0 Bytes: 0 ]
As we can see here, only one packet - the initial ping request - matched the table, but all packets passing as the result of the state are correctly accounted for. Reloading the table(s) or ruleset will not affect packet accounting in any way. The two “XPass” counters are incremented instead of the “Pass” counters when a “stateful” packet is passed but doesn't match the table anymore. This will happen in our example if someone flushes the table while the
ping(8) command is running.
When used with a single
-v,
pfctl will only display the first line containing the table flags and name. The flags are defined as follows:
c
For constant tables, which cannot be altered outside
pf.conf(5).
p
For persistent tables, which don't get automatically killed when no rules refer to them.
a
For tables which are part of the active tableset. Tables without this flag do not really exist, cannot contain addresses, and are only listed if the -g flag is given.
i
For tables which are part of the
inactive tableset. This flag can only be witnessed briefly during the loading of
pf.conf(5).
r
For tables which are referenced (used) by rules.
h
This flag is set when a table in the main ruleset is hidden by one or more tables of the same name from anchors attached below it.