Re: Numen with reference to vmap

[Phil Sutter <phil@nwl.cc>]

Hi Serguei,

On Tue, Dec 17, 2019 at 12:51:07AM +0000, Serguei Bezverkhi (sbezverk) wrote:
> In this google doc, see link: https://docs.google.com/document/d/128gllbr_o-40pD2i0D14zMNdtCwRYR7YM49T4L2Eyac/edit?usp=sharing

I avoid Google-Doc as far as possible. ;)

> There is a question about possible optimizations. I was wondering if you could comment/reply. Also I got one more question about updates of a set. Let's say there is a set with 10k entries, how costly would be the update of such set.

Regarding Rob's question: With iptables, for N balanced servers there
are N rules. With equal probabilities a package traverses N/2 rules on
average (unless I'm mistaken). With nftables, there's a single rule
which triggers the map lookup. In kernel, that's a lookup in rhashtable
and therefore performs quite well.

Another aspect to Rob's question is jitter: With iptables solution, a
packet may traverse all N rules before it is dispatched. The nftables
map lookup will happen in almost constant time.

I can't give you performance numbers, but it should be easy to measure.
Given that you won't need set content for insert or delete operations
while iptables fetches the whole table for each rule insert or delete
command, I guess you can imagine how the numbers will look like. But
feel free to verify, it's fun! :)

Cheers, Phil