pf's DSCP mark kept in hardware, measured on the XGS 3300 and the XGS 136, 2026-10-24
Discovery 8 of the discoveries,
taken from the source to a product. A rule that sets a DSCP - OPNsense's normalization rule
(Firewall: Settings: Normalization, TOS / DSCP) - has pf write that value into every frame of the
connections it matches. Until today a connection in hardware lost the mark: the fast path
forwarded its frames as they came, measured below. The fast path can write the value itself - each
microflow carries a DSCP override (dscp_override_en, dscp_override_val) - and since today both
drivers give it pf's value when they make a connection, for both directions.
The whole page, with how it was taken and what it does not show: pf's DSCP mark kept in hardware, measured on the XGS 3300 and the XGS 136, 2026-10-24.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.