From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel@vger.kernel.org
Subject: Re: [PATCH v2 0/3] netfilter: connlimit: scalability improvements
Date: Mon, 17 Mar 2014 12:44:44 +0100 [thread overview]
Message-ID: <20140317114444.GA9555@localhost> (raw)
In-Reply-To: <1394664591-21843-1-git-send-email-fw@strlen.de>
On Wed, Mar 12, 2014 at 11:49:48PM +0100, Florian Westphal wrote:
> Resending the last three patches of the set; I have addressed
> the comments I've received. See individual patches on whats
> changed vs v1.
>
> I've done a brief re-rest with 2-hrs of synflooding and
> nf_conntrack_max=2000000 plus conntrack -F every 10 seconds and did not
> encounter any issues.
>
> I am copying the original v1 cover letter below.
>
> The connlimit match suffers from two problems:
>
> - lock contention when multiple cpus invoke the match function
> - algorithmic complexity: on average the connlimit match will need to
> examine NUMBER_OF_CONNTRACKS % HASH_BUCKET (always 256) connections
> as the match will test for every connection assigned to the same bucked
> as the new one wheter the conntrack is still active.
>
> This patch set tries to solve both issues.
Series applied, thanks Florian.
prev parent reply other threads:[~2014-03-17 11:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-03-12 22:49 [PATCH v2 0/3] netfilter: connlimit: scalability improvements Florian Westphal
2014-03-12 22:49 ` [PATCH v2 1/3] netfilter: connlimit: use keyed locks Florian Westphal
2014-03-12 22:49 ` [PATCH v2 2/3] netfilter: connlimit: make same_source_net signed Florian Westphal
2014-03-12 22:49 ` [PATCH v2 3/3] netfilter: connlimit: use rbtree for per-host conntrack obj storage Florian Westphal
2014-03-17 11:44 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140317114444.GA9555@localhost \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.