Accessing conntrack memory on multicore machine

Accessing conntrack memory on multicore machine

[Nishit Shah]

Hi,
            I have following setup.

[root@manage scripts]# cat /proc/interrupts 
           CPU0                 CPU1       
  0:     228177                547                   IO-APIC-edge     
          timer
  2:          0                    0                                XT-PIC 
              cascade
  4:        446                  0                     
IO-APIC-edge                serial
  8:          1                    1                      IO-APIC-edge 
              rtc
 16:        137                 0                      IO-APIC-level 
               eth0, eth10, eth12, eth6, eth8
 17:       1710                 0                      IO-APIC-level 
               eth1, eth11, eth13, eth2, eth7, eth9
 18:         54                  1                      IO-APIC-level 
               eth3, eth4
 19:       7454                 0                      IO-APIC-level 
               libata, eth5
NMI:          0                  0 
LOC:     228829             229844 
ERR:          0
MIS:          0

I want to bind interrupts on eth0 to CPU0 and eth1 to CPU1

       echo 1 > /proc/irq/16/smp_affinity
       echo 2 > /proc/irq/17/smp_affinity


Now,
            I am using CONNMARK  target to do mark on conntrack. Here
packets with direction IP_CT_DIR_ORIGINAL are marked with 1 and packets with
direction IP_CT_DIR_REPLY are marked with 2. Now as eth0 and eth1 are served
by different CPUs, is there chances of –m connmark will get wrong values of
conntrack mark ?


Rgds,
Nishit Shah

Re: Accessing conntrack memory on multicore machine

[Patrick McHardy]

Nishit Shah wrote:
> Now,
>             I am using CONNMARK  target to do mark on conntrack. Here
> packets with direction IP_CT_DIR_ORIGINAL are marked with 1 and packets with
> direction IP_CT_DIR_REPLY are marked with 2. Now as eth0 and eth1 are served
> by different CPUs, is there chances of –m connmark will get wrong values of
> conntrack mark ?


Yes, you should mark the packet and not the connection since
the direction is a property of the packet.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html