From: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
To: Amin Azez <azez@ufomechanic.net>
Cc: netfilter-devel@lists.netfilter.org
Subject: Re: iptables modules efficiency, caching in conntrack
Date: Mon, 15 May 2006 21:29:57 +0200 [thread overview]
Message-ID: <4468D6B5.20108@gmx.net> (raw)
In-Reply-To: <e4a6bo$evh$1@sea.gmane.org>
Hi Amin,
Amin Azez wrote:
> I've done work with a few iptables modules, conntrack, ipt_recent,
> ipt_account (recently) and others.
>
> The design usually consists of a module specific storage using some
> aspects of the connection or packet as a key to the storage.
>
> For each packet, each module calculates the key, fetches and locks the
> storage record, makes decisions and updates, unlocks and continues.
>
> I also notice a similarity between many modules, ipt_set, ipt_recent,
> ipt_account, and think how much space and time is used less efficiently
> when more than one of these are used together.
Have you looked at ipt_ACCOUNT (the capitalized one)? IIRC their storage
model is quite efficient and works fine even under memory pressure and
requires only 0-order-allocations.
If you want, I can supply you with a 64-bit-clean kernel-2.6 version
of ipt_ACCOUNT.
Regards,
Carl-Daniel
--
http://www.hailfinger.org/
prev parent reply other threads:[~2006-05-15 19:29 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2006-05-15 15:22 iptables modules efficiency, caching in conntrack Amin Azez
2006-05-15 19:29 ` Carl-Daniel Hailfinger [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4468D6B5.20108@gmx.net \
--to=c-d.hailfinger.devel.2006@gmx.net \
--cc=azez@ufomechanic.net \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.