Traffic Shaping monitor
Is there a method I'm not aware of that reveals which connections are hitting each traffic shaping rule? Would I have to tag packets with a floating rule then packet capture at the WAN by the diffserv tag? Or is there a more graphical way of doing this? Other than making one item in the Queue page spike against background traffic I'm not finding an easy way to monitor traffic, by rule, to prove out new floating rules.
There isn't a way to see which connections hit which queue.
You can't insert a diffserv tag into a packet using a rule, that's just for matching, not setting.
pf can tag connections internally but those also wouldn't be exposed in a way that wireshark can see.
So any suggestions on the best method to determine that specific traffic is hitting the floating rules? Is spiking the queue page with an outboard packet generator the best we got?
Happened across my own answer. PfTop, Rules view.