Re: New Target: ipt_ACCOUNT

[Harald Welte <laforge@gnumonks.org>]

[-- Attachment #1: Type: text/plain, Size: 1857 bytes --]

On Mon, Dec 16, 2002 at 06:36:22PM +0100, Rolf Wuerdemann wrote:
> Hi there ...

Hi, sorry for my late reply.

> we've developed a new target for iptables: ipt_ACCOUNT.
> This Target accounts Traffik on a packet-base on source and
> target ip using netfilter (similar to nacctd - but using iptables).
> 
> It's in use on our routers (app. 60MBit/s Bandwitdh) since three month
> (app.) without any trouble and was tested with some DDoS-Tools before
> use ;)

great news.  A couple of comments:

 I think this is the wrong approach, there are way too much data
strucctures in non-swappable kernel momory allocated.  And kernel-OOM is
not something we should provoke.  A better architecture from my point of
view was: - use ULOG to copy the IP+TCP header of all packets to
userspace [it is very efficient in doing so!!!] and then do all the
accounting in userspace

Leaving this personal view aside, I still dislike a couple of issues
with your patch

- It doesn't adhere to the kernel CodingStyle 
	- german variables
	- C++ style comments
	- more than 80chars per line
- the kernel/userspace interface using a socket option

So if you want to contribute it into patch-o-matic, you will have to
at least conform to the coding style, sorry.

> PS: We've developed it 'cause nacctd was 
> 	a) to much use of cpu
> 	b) looses packets during kernel-problems with PF_PACKET

I am (as a long time nacctd user and hacker) aware of those issues.  But
this doesn't mean that moving everything into the kernel is the right
thing..

-- 
- Harald Welte / laforge@gnumonks.org               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]