Jitter phenomenon in the netfilter infrastructure

Jitter phenomenon in the netfilter infrastructure

[Mike-Ro-Chanel]

Hi All,
Inspired by ipt_limit module I've written a token bucket module as a 
iptables module extension.

I've observed a strange behaviour:
In the linux kernel 2.4.21 input ethernet frames are sent to the IPv4 
layer by "process_backlog()" function, this one pass to ip_rcv() 
hundreds of SKB elements in a single burst, its execution is limited (in 
time) by 1 jiffy.
As result a regular IPv4 input traffic is looked by PREROUTING hook as 
an irregular flow of packets.

Looking this phenomenon I think: an ingress bandwidth filter as 
netfilter module is unfeasible.

Is my opinion wrong?

Any suggestions?

Thanks

	Mike-Ro-Chanel

Re: Jitter phenomenon in the netfilter infrastructure

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1096 bytes --]

On Thu, Oct 16, 2003 at 09:42:53AM +0200, Mike-Ro-Chanel wrote:
> Hi All,
> Inspired by ipt_limit module I've written a token bucket module as a 
> iptables module extension.
> 
> I've observed a strange behaviour:
> In the linux kernel 2.4.21 input ethernet frames are sent to the IPv4 
> layer by "process_backlog()" function, this one pass to ip_rcv() 
> hundreds of SKB elements in a single burst, its execution is limited (in 
> time) by 1 jiffy.
> As result a regular IPv4 input traffic is looked by PREROUTING hook as 
> an irregular flow of packets.

yes, but you have an skb receive timestamp, which tells you the exact
jiffies at which the skb came in from the wire.

> Thanks
> 	Mike-Ro-Chanel

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]