Re: question regarding iptables tuning (was Re: iptables denial of services)

[Herve Eychenne <rv@wallfire.org>]

On Sat, Apr 17, 2004 at 10:58:14PM +0200, Martin Josefsson wrote:

> On Sat, 2004-04-17 at 22:41, Friedrich Lobenstock wrote:

> > > The new hashfunction (jenkins) doesn't need that (2.4 and 2.6 has it).
> > > It's very happy with 2^n sizes, in fact it's happy with all sizes :)

Too bad I didn't hear that from anyone when I posted the link to my
document some months ago...

> > Since which official kernel 2.4 release do we have the new hash? If it is 
> > just 2.4.24 or up then you should still need to mention this fact about the 
> > prime number. See the one guy posting about kernel 2.4.20.

> I don't remember since which kernel. Tell the person who wrote that
> document to update it.
> Please don't mention kernel 2.4.20, conntrack is horribly broken in
> 2.4.20 unless patched...

I've checked, and the change in hash algorithm appeared in 2.4.21.
I have updated the document accordingly.

Here is the new version:
http://www.wallfire.org/misc/netfilter_conntrack_perf.txt

 Herve

-- 
 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/