Optionally, a preprocessor can be specified using -p preproc where file is to be piped through. If preproc doesn't start with a slash as its first character, the usual PATH name search is performed. Each packet that has been received or is about to be sent goes through the ipfw rules. The ipfw code works by going through the rule-list for each packet until a match is found.
All rules have two associated counters, a packet count and a byte count.
These counters are updated when a packet matches the rule. Rules are tried in increasing order, and the first rule that matches a packet applies. Multiple rules may share the same number and apply in the order in which they were added. If a rule is added without a number, it is numbered 100 higher than the highest defined rule number, unless the highest defined rule number is 65435 or greater, in which case new rules are given that same number. The delete operation deletes the first rule with number number , if any.