ACKs create separate state

--Apple-Mail=_AC32110F-D406-4686-9D0A-1857E0DE0392
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

Hello,

this rule:

@189 pass in quick on enc0 inet proto tcp from <f2_all_nets:5> to =
192.168.223.200 port =3D 601 \
 flags S/FSRA tag VPN_DMZ1
@190 pass in quick on enc0 inet6 proto tcp from <f2_all_nets:5> to =
abcd:2222:3333:4444::200 port =3D 601 \
 flags S/FSRA tag VPN_DMZ1

(expanded from
  pass in quick on enc0 proto tcp from <f2_all_nets>  to $loghost \
                port $port_rsyslog tag VPN_DMZ1 $tcp_options_floating)

does not work (no block message).

There seems to be a separate state for ACKs:

20:34:47.222627 1234:56:78:9a::81.63783 > abcd:2222:3333:4444::200.601: =
S \
 [tcp sum ok] 3045515540:3045515540(0) win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 4047232668 0> [flowlabel =
0xe1575] \
 (len 40, hlim 62)
20:34:47.223345 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63783: =
S \
 [tcp sum ok] 3961027930:3961027930(0) ack 3045515541 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3982283807 4047232668> \
 [flowlabel 0x87d5a] (len 40, hlim 64)
20:34:48.247490 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63783: =
S \
 [tcp sum ok] 3961027930:3961027930(0) ack 3045515541 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3982284831 4047232668> [class =
0x5] \
  [flowlabel 0x87d5a] (len 40, hlim 64)
20:34:49.308485 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63782: =
S \
 [tcp sum ok] 4229674314:4229674314(0) ack 405776979 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 709374688 1681817866> [class =
0x5] \
 [flowlabel 0xbb54a] (len 40, hlim 64)
20:34:50.467695 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63783: =
S \
 [tcp sum ok] 3961027930:3961027930(0) ack 3045515541 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3982287052 4047232668> [class =
0x5] \
 [flowlabel 0x87d5a] (len 40, hlim 64)
20:34:53.561599 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63782: =
S \
 [tcp sum ok] 4229674314:4229674314(0) ack 405776979 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 709378941 1681817866> \
 [flowlabel 0xbb54a] (len 40, hlim 64)
20:34:54.701715 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63783: =
S \
 [tcp sum ok] 3961027930:3961027930(0) ack 3045515541 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3982291286 4047232668> [class =
0x5] \
 [flowlabel 0x87d5a] (len 40, hlim 64)
20:35:16.492774 1234:56:78:9a::81.63803 > abcd:2222:3333:4444::200.601: =
S \
 [tcp sum ok] 3229177067:3229177067(0) win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3700208506 0> \
 [flowlabel 0x88963] (len 40, hlim 62)
20:35:16.493295 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63803: =
S \
 [tcp sum ok] 1160594675:1160594675(0) ack 3229177068 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3615173800 3700208506> [class =
0x1] \
 [flowlabel 0xd44f3] (len 40, hlim 64)
20:35:17.549712 abcd:2222:3333:4444::200.601 > 1234:56:78:9a::81.63803: =
S \
 [tcp sum ok] 1160594675:1160594675(0) ack 3229177068 win 65535 \
 <mss 1440,nop,wscale 6,sackOK,timestamp 3615174857 3700208506> \
 [flowlabel 0xd44f3] (len 40, hlim 64)

What the hell is going on here?

Axel
---
PGP-Key: CDE74120  =E2=98=80  computing @ chaos claudius


--Apple-Mail=_AC32110F-D406-4686-9D0A-1857E0DE0392
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.2
Comment: GPGTools - http://gpgtools.org

iQIzBAEBCAAdFiEEl5evOTfnjZdhkBzKaPxTRM3nQSAFAl3ut40ACgkQaPxTRM3n
QSA76hAAh5IJgINf5fjjkENG3Sd4eLtnZjNhnhP06+j74uC+TbFiDoHo+KfmJs9d
tiPLAc5e/Hcq0EutjGXXbXe39tEaXdAuZbV7r+4PKXztRMfItxW047KhFTGLMPrz
4G23Y+3CwVEVCyLWkatL4vNZ6wAkagAvGL+oEg5MR4mzqsZHseURkcDq0AXmwq57
6nwQYBwNieDD2tYpEEhFF3Y47FAntJjvVsoyL4xhPhRka2WqRjQLudm+AUIU2crw
IhUouXzRNsExmT/B3EXYWok+ueamg6hYpSIfXY9rWLXFpsr805J/50KpG11n5Ls1
lYtZ+UUu1yy3beecsxHrIFyyDQluRnwLO+IVUKApKS1qqgvRFIcEVYXCV+hRfTlL
HJ4GQknOZt4jxr5V9gO0hTgJOwXttTp6uwfqFmQBb9incFixBNm1j3VwH4FfcINY
mA1Ullz9Yw80leKJD8G3z/r5g6ZPygZwhe7fdoS9k2zf1EvdlZw2Q01iHUgD4VxE
NO7mSvUeBtLZZHghnCJ7c7ikWNqmETGm5AxHdRmG5/UqiSyZKcOobWxYw0fhE+2y
YW1PiCY8p1M/8N4Fj5FcmnplthV0eQKrEGILY2DinkmtLGCoEOllLXq9lLV3tCAi
vjclOqOzKHCyRutgo/EhJFPUqXmVaqXr44eWmi8iH+Tkrymcrv8=
=JOMo
-----END PGP SIGNATURE-----

--Apple-Mail=_AC32110F-D406-4686-9D0A-1857E0DE0392--