Re: Rationale for BSD (I)PF rule order?

[Barney Wolff <barney () databus com>]

On Thu, May 08, 2003 at 02:59:39PM +0200, Volker Tanger wrote:
> I was not able to find a rationale for the BSD type of packet filter
> application. Where most FW/ACL implementations follow "first match", BSD
> usually takes "last match" (if you don't use the "quick" method).
>
> Is there a reason why that was decided this way? Especially as I
> currently cannot see advantages for this behaviour, only performance
> disadvantages. Can someone enlighten me here?

I can't supply a rationale for last-match, but note that ipfw is first
match, not last.

-- 
Barney Wolff         http://www.databus.com/bwresume.pdf
I'm available by contract or FT, in the NYC metro area or via the 'Net.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards