aboutsummaryrefslogtreecommitdiff
path: root/sbin
diff options
context:
space:
mode:
authorEugene Grosbein <eugen@FreeBSD.org>2025-12-28 17:05:22 +0000
committerEugene Grosbein <eugen@FreeBSD.org>2025-12-28 17:05:22 +0000
commita7b8a5d37bcb0009297962137bfb6c6570e5af12 (patch)
tree8baf1c7e65ec0fb18a6052b6f90acd64475c7fc3 /sbin
parent176075e661fc657845d788ab3451e690c4e9bac6 (diff)
Diffstat (limited to 'sbin')
-rw-r--r--sbin/ipfw/ipfw.88
1 files changed, 6 insertions, 2 deletions
diff --git a/sbin/ipfw/ipfw.8 b/sbin/ipfw/ipfw.8
index 7a81c84de3e4..bafad1479c0e 100644
--- a/sbin/ipfw/ipfw.8
+++ b/sbin/ipfw/ipfw.8
@@ -839,8 +839,12 @@ When a packet matches a rule with the
.Cm setmark
keyword, a 32-bit numeric mark is assigned to the packet.
The mark is an extension to the tags.
-As tags, mark is "sticky" so the value is kept the same within the kernel and
-is lost when the packet leaves the kernel.
+The mark is preserved for a packet within a single ipfw rulese traversal
+and is lost when the packet is checked against the active ruleset
+next time (see
+.Sx PACKET FLOW
+section) or leaves ipfw context (e.g. accepted,
+diverted, bridged or routed).
Unlike tags, mark can be matched as a lookup table key or compared with bitwise
mask applied against another value.
Each packet can have only one mark, so