All of lore.kernel.org
 help / color / mirror / Atom feed
From: "zhengchuanbo" <zhengcb@netpower.com.cn>
To: netfilter-devel@lists.netfilter.org
	<netfilter-devel@lists.netfilter.org>
Subject: to solve the performance problem of netfilter
Date: Wed, 17 Dec 2003 10:29:9 +0800	[thread overview]
Message-ID: <200312171018140.SM00864@zhengcb> (raw)


I noticed that the netfilter module has a big influnce to the performance. 
I tested the throughput of our linux firewall. the result is as follows,
	linux(no netfilter)					580kpps
	with netfilter(no ip_conntrack)	    450kpps
	with ip_conntrack					295kpps
So the throughput dropped about 40% when with ip_conntrack.

I tried NOTRACK module, but the performance is not very good.
	
On our linux firewall, most of the traffic are from a trusted host on the 
DMZ server, which need not to be filtered. So I wish there could be a solution
to open a fast path to the certain server, with no conntrack nor filter.   	
Somebody suggested to install a netfilter-module that gets the packets before 
conntrack and steal the packets, and bypass the rest of iptables as well. Is there
any ideas on that?
	
thanks.
	
regards,
Jack Zheng
zhengcb@netpower.com.cn

             reply	other threads:[~2003-12-17  2:29 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2003-12-17  2:29 zhengchuanbo [this message]
  -- strict thread matches above, loose matches on Subject: below --
2003-12-17 10:57 to solve the performance problem of netfilter tady
2003-12-17 15:27 ` Roberto Nibali
2003-12-17 15:55   ` KOVACS Krisztian
2003-12-17 17:01     ` Roberto Nibali
2003-12-17 17:09     ` Henrik Nordstrom
2003-12-18 12:02       ` Jozsef Kadlecsik

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=200312171018140.SM00864@zhengcb \
    --to=zhengcb@netpower.com.cn \
    --cc=netfilter-devel@lists.netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.