From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: Netfilter Performance when using MAC filter
Date: Thu, 01 Nov 2007 11:05:10 +0100 [thread overview]
Message-ID: <4729A4D6.2020106@plouf.fr.eu.org> (raw)
In-Reply-To: <1193859183.5142.2.camel@grateful.d.umn.edu>
Matt Zagrabelny a écrit :
> On Wed, 2007-10-31 at 20:19 +0100, Pascal Hambourg wrote:
>
>>Matt Zagrabelny a écrit :
>>
>>>If so, you can do MAC filtering (performance shouldn't matter as the MAC
>>>address is in the link header)
>>
>>Can you please elaborate about the relationship beween filtering
>>performance and the address layer ?
>
> There is nothing to elaborate on. ;)
>
> The frame contains the MAC address. This is what iptables will be
> looking at. If the box running iptables is on the same network/vlan as
> the rest of the traffic it is expecting to filter, then it will have MAC
> addresses of actual hosts, however, if traffic is coming from a
> different network/vlan then said traffic will have been routed and the
> frame will have changed, thus the MAC address will be the MAC of the
> network boundary, namely the router/gateway.
Sorry, but I still do not see the point in "performance shouldn't matter
as the MAC address is in the link header". Performance (read : speed) is
mostly related to the number of rules, isn't it ?
next prev parent reply other threads:[~2007-11-01 10:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-31 16:23 Netfilter Performance when using MAC filter Babu Skeitson
2007-10-31 18:26 ` Matt Zagrabelny
2007-10-31 18:41 ` Grant Taylor
2007-10-31 19:19 ` Pascal Hambourg
2007-10-31 19:33 ` Matt Zagrabelny
2007-11-01 10:05 ` Pascal Hambourg [this message]
2007-11-01 13:17 ` Matt Zagrabelny
2007-11-01 14:55 ` Pascal Hambourg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4729A4D6.2020106@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.