what come first: pf or sensei?

[siga75]

my logic tell me it should be pf first then sensei, but based on some observation it looks like the opposite.

just to be sure since I see a strange behavior in sensei filtering and I would like to know it before deeper investigation

[mimugmail]

Sensei first. It like packet capture where you would also see blocked packets

[siga75]

thanks mimu

then there's maybe some issues with sensei not correctly blocking stuff