Preventing livelock

One basic recipe: Make sure that no work is wasted.
privilege partially-processed packets over new incoming ones;
process packets to completion

sysctl net.inet.ip.fastforwarding=1

not compatible with firewall
not enough for servers: only queues packets to sockets.
system still not controllable, all cycles go to low level kernel tasks.