diff -ru src/sbin/ipfw/ipfw.8 src-mypatch/sbin/ipfw/ipfw.8
--- src/sbin/ipfw/ipfw.8	Mon Mar  5 20:33:42 2001
+++ src-mypatch/sbin/ipfw/ipfw.8	Thu Aug 16 20:45:24 2001
@@ -634,6 +634,10 @@
 The actual behaviour can be modified by specifying a different
 .Ar method ,
 although at the moment only the default one is specified.
+.It Cm in-state
+Matches only packets that belong to an established connection
+in the dynamic ruleset. Use together with keep-state, only in
+rare cases.
 .It Cm bridged
 Matches only bridged packets.
 This can be useful for multicast or broadcast traffic, which
diff -ru src/sbin/ipfw/ipfw.c src-mypatch/sbin/ipfw/ipfw.c
--- src/sbin/ipfw/ipfw.c	Tue Feb 20 12:39:11 2001
+++ src-mypatch/sbin/ipfw/ipfw.c	Thu Aug  9 19:33:07 2001
@@ -418,6 +418,9 @@
 	if (chain->fw_flg & IP_FW_F_FRAG)
 		printf(" frag");
 
+        if (chain->fw_flg & IP_FW_F_INSTATE)
+                printf(" in-state");
+
 	if (chain->fw_ipopt || chain->fw_ipnopt) {
 		int 	_opt_printed = 0;
 #define PRINTOPT(x)	{if (_opt_printed) printf(",");\
@@ -837,6 +840,7 @@
 "    uid {user id}\n"
 "    gid {group id}\n"
 "    fragment     (may not be used with ports or tcpflags)\n"
+"    in-state     (matches if packet matches a connection in dynamic ruleset)\n"
 "    in\n"
 "    out\n"
 "    {xmit|recv|via} {iface|ip|any}\n"
@@ -1901,6 +1905,10 @@
 			rule.fw_flg |= IP_FW_F_FRAG;
 			av++; ac--; continue;
 		}
+                if (!strncmp(*av,"in-state",strlen(*av))) {
+                  rule.fw_flg |= IP_FW_F_INSTATE;
+                  av++; ac--; continue;
+                }
 		if (!strncmp(*av,"ipoptions",strlen(*av))) { 
 			av++; ac--; 
 			if (!ac)
diff -ru src/sys/netinet/ip_fw.c src-mypatch/sys/netinet/ip_fw.c
--- src/sys/netinet/ip_fw.c	Wed Mar 28 07:19:00 2001
+++ src-mypatch/sys/netinet/ip_fw.c	Thu Aug 16 19:30:02 2001
@@ -1043,25 +1043,34 @@
 		if (f->fw_number == IPFW_DEFAULT_RULE)
 		    goto got_match ;
 
+                /*
+                 * Check if packet matches any state
+                 */
+		if (f->fw_flg & IP_FW_F_INSTATE) {
+                  if(lookup_dyn_rule(&last_pkt, &direction) == NULL) continue;
+		}
+
 		/*
-		 * dynamic rules are checked at the first keep-state or
-		 * check-state occurrence.
+		 * dynamic rules are checked at the first keep-state
+		 * or check-state occurrence.
 		 */
 		if (f->fw_flg & (IP_FW_F_KEEP_S|IP_FW_F_CHECK_S) &&
 			 dyn_checked == 0 ) {
-		    dyn_checked = 1 ;
+                    dyn_checked = 1 ;
 		    q = lookup_dyn_rule(&last_pkt, &direction);
 		    if (q != NULL) {
 			DEB(printf("-- dynamic match 0x%08x %d %s 0x%08x %d\n",
 			    (q->id.src_ip), (q->id.src_port),
 			    (direction == MATCH_FORWARD ? "-->" : "<--"),
 			    (q->id.dst_ip), (q->id.dst_port) ); )
-			chain = q->chain ;
-			f = chain->rule ;
-			q->pcnt++ ;
-			q->bcnt += ip_len;
-			goto got_match ; /* random not allowed here */
+
+                        chain = q->chain ;
+                        f = chain->rule ;
+                        q->pcnt++ ;
+                        q->bcnt += ip_len;
+                        goto got_match ; /* random not allowed here */
 		    }
+
 		    /* if this was a check-only rule, continue with next */
 		    if (f->fw_flg & IP_FW_F_CHECK_S)
 			continue ;
@@ -1658,6 +1667,10 @@
 	}
 	if (frwl->fw_flg == IP_FW_F_CHECK_S) {
 		/* check-state */
+		return 0 ;
+	}
+	if (frwl->fw_flg == IP_FW_F_INSTATE) {
+		/* in-state */
 		return 0 ;
 	}
 	/* Must apply to incoming or outgoing (or both) */
diff -ru src/sys/netinet/ip_fw.h src-mypatch/sys/netinet/ip_fw.h
--- src/sys/netinet/ip_fw.h	Tue Feb 20 12:39:17 2001
+++ src-mypatch/sys/netinet/ip_fw.h	Thu Aug  9 21:03:46 2001
@@ -209,7 +209,9 @@
 #define IP_FW_F_SME	0x20000000	/* source = me				*/
 #define IP_FW_F_DME	0x40000000	/* destination = me			*/
 
-#define IP_FW_F_MASK	0x7FFFFFFF	/* All possible flag bits mask		*/
+#define IP_FW_F_INSTATE	0x80000000	/* in state				*/
+
+#define IP_FW_F_MASK	0xFFFFFFFF	/* All possible flag bits mask		*/
 
 /*
  * Flags for the 'fw_ipflg' field, for comparing values of ip and its protocols.
