Re: why every time that a rule is inserted/appended....

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1178 bytes --]

On Mon, May 26, 2003 at 06:34:51PM -0300, diegows wrote:
> ...the entire table is replaced?

the idea was to have an atomic snapshot from the kernel, which is
especially important for the counters.

ipchains doesn't read a chain atomically and thus packets are still
traversing between rules are being read from the kernel.  This leads to
inconsistencies in 

> If this could be better, advise me and i try to patch that.

Sure it can be done better, and there have been at least two approaches
to introduce a new kernel/userspace interface, both based on nfnetlink.

However, this is not a 'small patch' but a fundamental design change.

[maybe I'll finally find some time to do pkttables stuff again... but
now there is lots of other distracting stuff like that dual opteron box
;)]

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]