A cooperative's NOC wants a firewall-filter term that tallies how much traffic from a suspicious source address is arriving at a POP router, but still lets that traffic continue to be evaluated against the remaining terms in the filter. Which kind of then action should the term use?

Junos firewall-filter then actions split into terminating and non-terminating categories. Terminating actions — accept, discard, and reject — end evaluation of the packet against that filter immediately once the action is applied, so no later term in the filter gets a chance to inspect the packet. Non-terminating actions, such as count, log, and syslog, record information about the matching packet but explicitly allow processing to fall through to the next term in sequence. Accept is wrong here because, while it lets the packet through the device, it is still terminating for filter-evaluation purposes and would prevent any later term (say, a rate-limiting term) from ever being checked. Discard and reject are both terminating and both drop the packet outright — discard silently, reject with a notification back to the sender — which is the opposite of the NOC's goal of continued observation. Choosing count lets the operator build a term that tags and measures the suspicious source's traffic volume while still subjecting it to whatever later terms exist, such as a policer or an eventual explicit deny. A good operational check is 'show firewall filter <name>' after traffic passes, confirming the count-bearing term's counter increments while later terms in the same filter also show activity from that same source.