It would be nice to have per-rule counters which count how many times the
rule has been hit since last counter reset. This would help the
administrator to remove dead rules (ones which are no longer needed due to
software upgrades etc). This would help tighten the ruleset - a tight
ruleset is the basis for a well-maintained machine. Rules which have not
been hit for a certain (configurable) amount of time should get appended to
the report together with the date of the last hit.

control: tags -1 + confirmed - wontfix
thanks

This is exactly what ive been thinking of, as a way to sort rules so the
most frequently matched ones happen first.

(i dont know if it will actually save any time, as there will be a lot of
overhead. but it might - eg i doubt courier rules have ever matched a
message for me but my iptables rules hit something on every run)

(i have a way to count matches already, - very untested - but im less sure
of a simple algorithm to sort things. but seems like fun to think about. )

(will revist post bookworm)