From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Jan Engelhardt <jengelh@inai.de>
Cc: Jim Mellander <jmellander@lbl.gov>, netfilter@vger.kernel.org
Subject: Re: Netfilter applied to specific interfaces only
Date: Sat, 9 Mar 2013 23:10:44 +0100 [thread overview]
Message-ID: <20130309221044.GA3419@localhost> (raw)
In-Reply-To: <alpine.LNX.2.01.1303082046110.28399@nerf07.vanv.qr>
On Fri, Mar 08, 2013 at 08:52:37PM +0100, Jan Engelhardt wrote:
>
> On Friday 2013-03-08 20:14, Jim Mellander wrote:
> >
> >In the HPC world, and in network intrusion detection, network
> >performance is paramount. We've found that just having the iptables
> >kernel module loaded without any ruleset substantially reduces
> >performance at high traffic rates.
>
> This one is a known issue with ip_tables/x_tables, and solved in
> xtables2 where you can deallocate the base chains when empty -- (more
> accurately, they do not exist by default and need to be created first)
> -- given finer control over what is being executed.
Just for the record: this idea was initially introduced by nftables
back in 2009.
Regards.
next prev parent reply other threads:[~2013-03-09 22:10 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-03-08 19:14 Netfilter applied to specific interfaces only Jim Mellander
2013-03-08 19:52 ` Jan Engelhardt
2013-03-09 22:10 ` Pablo Neira Ayuso [this message]
2013-03-11 7:55 ` Jan Engelhardt
2013-03-10 14:34 ` Humberto Jucá
-- strict thread matches above, loose matches on Subject: below --
2013-03-11 2:46 Neal Murphy
2013-03-11 11:42 ` Humberto Jucá
2013-03-15 17:36 ` Jim Mellander
2013-03-15 19:25 ` Jozsef Kadlecsik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130309221044.GA3419@localhost \
--to=pablo@netfilter.org \
--cc=jengelh@inai.de \
--cc=jmellander@lbl.gov \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.