Re: Netfilter Performance when using MAC filter

[Matt Zagrabelny <mzagrabe@d.umn.edu>]

[-- Attachment #1: Type: text/plain, Size: 1054 bytes --]


On Wed, 2007-10-31 at 14:23 -0200, Babu Skeitson wrote:
> Hello everyone.
> I'm thinking about implementing iptables MAC Address filtering (-m mac
> --mac-source xx:xx....) in my network.
> *BUT* I have a big network, with ~ 4000 internal hosts/IPs that will
> be filtered via MAC, and I'm not sure about the performance of this
> filtering.

Are the 4000 hosts on the same network/vlan as the box running iptables?

If so, you can do MAC filtering (performance shouldn't matter as the MAC
address is in the link header), if not MAC filtering won't buy you much,
the layer2 address will always be the same.

This is essentially the difference between ARP and IP, or switching and
routing if you prefer.

-- 
Matt Zagrabelny - mzagrabe@d.umn.edu - (218) 726 8844
University of Minnesota Duluth
Information Technology Systems & Services
PGP key 1024D/84E22DA2 2005-11-07
Fingerprint: 78F9 18B3 EF58 56F5 FC85  C5CA 53E7 887F 84E2 2DA2

He is not a fool who gives up what he cannot keep to gain what he cannot
lose.
-Jim Elliot

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]