Reject packets in pf after a connection consumed a certain amount of traffic In `pf` you can limit the bandwidth that is consumed (by for example ssh) using queues. I am hosting a UDP Service (Discard Protocol) which can easily eat up all my traffic when a client transfers data. Is there a way in `pf` to limit a connection or drop packets after a client connection consumed, lets say, 1GB of data?

This is not possible with pf alone—you’d have to couple it with something like pflow(4) and related to handle the traffic accounting. You might also be able to cook something up with some output from pfctl.