On Wed, 14 Feb 2007, Tim Kuhlman wrote:
[snip]
> So what is happening? It seems to me that either pf is broken or his linux

quoted text
> kernel is broken and pf is catching it. Any ideas as to which is the cause?

>

> One other point I needs some clarification on, in my searching around I did

> find an article saying that you need the "flags S/SA" everytime you use keep

> state for tcp connections in your firewall rules. This didn't seem right to

> me but I tried it anyway just to see and it had no affect. What is the final

> word on this, should you always use "flags S/SA"?

Not always, but very often. The main rule is to make sure that the

packet creating the state is not a packet of an already established

connection, but a packet creating the connection. Creating the state

from the beginning allows pf to get the info about the window scaling

and other tcp options used. 
Using flags S/SA keep state is the easiest way to achieve that. Note

that on current, this is the default.
	-Otto