From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Vishwanath Pai <vpai@akamai.com>
Cc: kadlec@blackhole.kfki.hu, netfilter-devel@vger.kernel.org,
johunt@akamai.com, fw@strlen.de, netdev@vger.kernel.org,
pai.vishwain@gmail.com
Subject: Re: [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for xt_hashlimit
Date: Mon, 4 Sep 2017 13:31:28 +0200 [thread overview]
Message-ID: <20170904113128.GA3757@salvia> (raw)
In-Reply-To: <20170904101433.GA3979@salvia>
On Mon, Sep 04, 2017 at 12:14:33PM +0200, Pablo Neira Ayuso wrote:
> On Fri, Aug 18, 2017 at 04:58:59PM -0400, Vishwanath Pai wrote:
> [...]
> > The main difference between the existing algorithm and the new one is
> > that the existing algorithm rate-limits the flow whereas the new
> > algorithm does not. Instead it *classifies* the flow based on whether
> > it is above or below a certain rate. I will demonstrate this with an
> > example below. Let us assume this rule:
> >
> > iptables -A INPUT -m hashlimit --hashlimit-above 10/s -j new_chain
> >
> > If the packet rate is 15/s, the existing algorithm would ACCEPT 10
> > packets every second and send 5 packets to "new_chain".
> >
> > But with the new algorithm, as long as the rate of 15/s is sustained,
> > all packets will continue to match and every packet is sent to new_chain.
>
> Sounds good, applied, thanks.
BTW, for the record, I have rename this patch title to:
netfilter: xt_hashlimit: add rate match mode
next prev parent reply other threads:[~2017-09-04 11:31 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-08-18 20:58 [PATCH 1/2] netfilter/xt_hashlimit: new feature/algorithm for xt_hashlimit Vishwanath Pai
2017-09-04 10:14 ` Pablo Neira Ayuso
2017-09-04 11:31 ` Pablo Neira Ayuso [this message]
2017-09-05 1:56 ` Vishwanath Pai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170904113128.GA3757@salvia \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=johunt@akamai.com \
--cc=kadlec@blackhole.kfki.hu \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pai.vishwain@gmail.com \
--cc=vpai@akamai.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.