Re: iptables rules in comparable form

[Radek Kanovsky <rk@dat.cz>]

On Tue, Jun 01, 2010 at 01:56:37PM +0200, Jan Engelhardt wrote:

> >Changes in /etc ruleset are small but frequent. But primarily both
> >solutions reset couters if used and it is not good for me now. So I
> >ended with script that does incremental updates.
> 
> How slow are we talking about? restore is never slower than
> iptables - ever, because, like iptables, it does one table replace
> operation per invocation of either binary. Your "incremental update"
> is in fact none, because tables are always replaced wholesome.

I take counters snapshot every minute for accounting. I can modify my
system a such way that changes are made immediately after this snapshot
phase via iptables-restore with reseting all counters in time very close
to the last read minimizing outage in accounting. But I can't rely on it
if restore phase takes from 1 seconds to 2 minutes. It would lead to
totally unreliable accounting data and more complicated system. Thats
why I came with incremental updates that doesn't touch unchanged rules.

Regards

Radek Kanovsky