From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anton Subject: Re: iptables performance and alternatives Date: Thu, 15 May 2008 15:57:27 +0500 Message-ID: <200805151557.28368.anton.vazir@gmail.com> References: <200805151421.23862.anton.vazir@gmail.com> <200805151535.31933.anton.vazir@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Cc: netfilter-devel To: Jan Engelhardt Return-path: Received: from mail.eastera.tj ([82.198.21.18]:37555 "EHLO mail.eastera.tj" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754057AbYEOK51 (ORCPT ); Thu, 15 May 2008 06:57:27 -0400 In-Reply-To: Content-Disposition: inline Sender: netfilter-devel-owner@vger.kernel.org List-ID: Definitelly what my test shows - while rule-inserts - if you try to insert 10000 rules - after a several hundreds - it will be inserting like a 1 rule in 1 second and slowness will progress :) regarding the further slowness inside the kernel - i'm reffering to the following tests, since did not do mine http://people.netfilter.org/kadlec/nftest.pdf and http://www.hipac.org/performance_tests/independent.html On Thursday 15 May 2008 15:43, Jan Engelhardt wrote: > On Thursday 2008-05-15 12:35, Anton wrote: > >> You missed IPMARK from Xtables-addons which does the > >> marking in O(1) instead of O(n). > > > >Great! This partially solves problem with marking while > > used with shaper, but in global scope - iptables > > remains slow? > > Slow, where?