From: Nick Drage <nickd@metastasis.org.uk>
To: netfilter@lists.netfilter.org
Subject: Re: bind 9 and iptables
Date: Sat, 28 Aug 2004 01:47:46 +0100 [thread overview]
Message-ID: <20040828004745.GC22322@metastasis.org.uk> (raw)
In-Reply-To: <D5C9032B2B09C64EA2409D6214E91AC90512F9@asimail2.alphanumeric.com>
On Fri, Aug 27, 2004 at 05:19:07PM -0400, Jason Opperisano wrote:
> long answer: it has been discussed on this list previously that
> connection tracking DNS queries/responses on or for a busy DNS server
> (i think the number was ~ 200 queries/second) will slow the name
> resolution process down. the reason being that the state creation
> adds noticeable, unnecessary latency, as most (all?) queries are one
> packet request--one packet response.
I've a vague recollection of being able to specify that a rule won't
create an entry in the state table, so for situations like this
netfilter can act faster, as long as you specify the correct rules for
connections both ways. However I can't find anything in the
documentation about this... after a cursory look... can anyone refresh
my memory?
--
mors omnia vincit
next prev parent reply other threads:[~2004-08-28 0:47 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <D5C9032B2B09C64EA2409D6214E91AC90512F9@asimail2.alphanumeric.co m>
2004-08-27 23:32 ` bind 9 and iptables it clown
[not found] ` <D5C9032B2B09C64EA2409D6214E91AC90512F9@asimail2.alphanumeric.com>
2004-08-28 0:47 ` Nick Drage [this message]
2004-08-28 1:58 ` Jose Maria Lopez
2004-08-28 4:40 ` dchemko
2004-08-30 19:08 Jason Opperisano
-- strict thread matches above, loose matches on Subject: below --
2004-08-27 23:40 Daniel Chemko
2004-08-27 23:34 Jason Opperisano
2004-08-28 0:00 ` it clown
2004-08-27 21:19 Jason Opperisano
2004-08-27 21:00 Jason Opperisano
2004-08-27 20:16 Jason Opperisano
2004-08-27 21:10 ` it clown
2004-08-27 20:06 it clown
2004-08-27 20:19 ` Nick Taylor
2004-08-27 20:53 ` it clown
2004-08-27 21:02 ` Nick Taylor
2004-08-27 20:37 ` Aleksandar Milivojevic
2004-08-28 0:44 ` Nick Drage
2004-08-28 5:02 ` Aleksandar Milivojevic
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040828004745.GC22322@metastasis.org.uk \
--to=nickd@metastasis.org.uk \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.