[RFC] ctnetlink events drop benchmark

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi,

Finally, I've got some results in my test enviroment about the ctnetlink 
event drop issue. The machine used as firewall is a PIII 866 256 Mbytes 
RAM, two NIC realtek 8139 100Mbits running debian unstable with linux 
kernel 2.6.16.

I have run the same test with three different socket queue sizes:
107.520 (default)
215.040 (x2)
430.080 (x4)

I used netperf to create the connections with a shell script that loops 
calling netperf -H ip -l 3 &.

To get the number of events dropped I've used the following:

$ conntrackd & (run as daemon)
$ conntrackd -s (request statistics)

Results are available in:

http://people.netfilter.org/pablo/ctnetlink/events.eps

Currently nlmsg_seq is not set in ctnetlink events, if we set it, we can 
do some kind of sequence tracking on netlink. If an event gets lost, we 
can request a resync with the conntrack via dump_conntrack.

Another choice could be relax conntrackd states transitions, currently 
the valid transition sequence is: NEW -> UPDATE -> DESTROY, if an UPDATE 
event is received but no NEW was seen previously, then the event is 
ignored. Maybe this is too tight, but since I'm validating the whole 
thing I prefer remaining "tight" at the moment.

Comments welcome.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of 
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris