On Tue, Feb 17, 2009 at 10:30:49PM +1000, David Gwynne wrote:
quoted text
> the pfsync_state_import and _export code are shared between both pfsync 
> and the pf ioctls. userland does read the state packet and byte  
> counters, so there is a point to it.

This is true, but the design decision predates the use of pfsync_* for
the pf ioctls.

In pre-pflow(4) days, people might also use the output on the pfsync
interface either directly or via some netflow conversion to gather usage
data for their traffic, so it's needed there as well.

In the original pfsync implementation I considered trying to synchronize
the counters as well, but making sure you don't over/under count if
packets hit both firewalls would have made it overly complicated.

-Ryan