Re: ULOG / netlink errors

[Pablo Neira <pablo@eurodev.net>]

Harald Welte wrote:

>On Sun, Nov 28, 2004 at 09:50:04PM +0100, Pablo Neira wrote:
>  
>
>>Pablo Neira wrote:
>>
>>    
>>
>>>this is ok, it's always a good idea to reduce the probability of an 
>>>overflow. But I think that you'll have problems anyway with traffers 
>>>rates bigger than ~20 Mbits/s.
>>>      
>>>
>>well, this is true in ip_queue, don't know in ipt_ULOG, it depends on 
>>three/four parameters.
>>    
>>
>
>just to let you know: there are people doing ULOG based acounting on >=
>100MBit.  So it's not as bad as you think it is ;)
>

I love netlink sockets, but loving someone/something implies knowing 
their limitations as well :)

I think that it depends on the settings, let me see what happen with an 
insane iptables rule like: iptables -I INPUT -j ULOG

>[no, I'm not advertising the use of ulog for accounting.  That's not
>what it was menat for].
>

I do also use ULOG(tm) to log packets, Since I do my hamster pet looks 
happier ;)

--
Pablo