=== DF-0632 test (firewall ENABLED) ===
Sun Jul 19 00:25:33 UTC 2026
net.inet.ip.fw3.enable: 0 -> 1
net.inet.ip.fw3.verbose: 0 -> 1
00100 allow tcp
00200 allow icmp keep-state
65535 deny
net.inet.ip.fw3_basic.state_max_icmp_out: 5 -> 5
net.inet.ip.fw3_basic.state_max_icmp_in: 5 -> 5
net.inet.ip.fw3_basic.icmp_timeout: 3 -> 3
net.inet.ip.fw3_basic.cleanup_interval: 1 -> 1
net.inet.ip.fw3.enable: 1
--- Initial counter ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=0 icmp_out=0
--- Send 1 ping to gateway (real outgoing traffic) ---
--- 10.0.2.2 ping statistics ---
1 packets transmitted, 1 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.213/0.213/0.213/0.000 ms
--- Counter after 1 ping ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=1
--- ipfw3 show (packet counts) ---
00100 0   0 allow tcp
00200 2 168 allow icmp keep-state
65535 0   0 deny
--- Round 1: send 6 pings with unique dst IPs ---
--- Counter after round 1 ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=6
--- Wait for timeout ---
--- Counter after expiry (BUG: should still show count, NOT 0) ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=6
--- Round 2: send 6 MORE pings ---
--- Counter after round 2 ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=6
--- Wait for second expiry ---
--- Counter after second expiry (BUG: should be cumulative, never decremented) ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=6
--- Round 3: send 5 more pings (counter should be pinned at max) ---
--- Final counter ---
DF0632 cpu0: tcp_in=0 tcp_out=0 udp_in=0 udp_out=0 icmp_in=1 icmp_out=6
00100  0    0 allow tcp
00200 19 1596 allow icmp keep-state
65535  0    0 deny
net.inet.ip.fw3.enable: 1 -> 0
Sun Jul 19 00:26:07 UTC 2026