From: "ericr" <ericr@ipro.net>
To: lartc@vger.kernel.org
Subject: [LARTC] Massive filtering
Date: Sat, 05 May 2007 05:30:36 +0000 [thread overview]
Message-ID: <200705050130.AA2025718096@ipro.net> (raw)
I am trying to build a trafic control rule set for a huge NATed network, and I have it working for single known addresses but I need to scale it to 16M potential client addresses. I'm using iptables for NAT. Incoming traffic is simple because I can match destination address, outgoing traffic I use iptables IPMARK then tc match mark and it works perfectly if I build rules for each client individually. I am worried about performance as the client list increases.
I need to place client IPs into classes like routers, freeloaders, lite-access, premium-access, etc. I have no problem with rewriting rules on the fly. It is easy to pop in a rule change any time a user authenticates or is disconnected for inactivity.
My first thought for scaling up was to use the hash tables, and I am feeling that the last line in lartc's document page "12.4. Hashing filters for very fast massive filtering" which says "Note that this example could be improved to the ideal case where each chain contains 1 filter!" is a little misleading since no divisor above 256 works. On first reading, I 'm thinking, yeh, I'll just put a divisor of 16777216 and my problems are solved... nope.. wrong answer. I haven't even gotten to the point where I issue 32 million filter rules to tc and see if it chokes.
I hate to have to ask, I am gratefull for all the work you have done just to get me here, I'm probably missing something important, but I'm trying to scale to 16 million potential clients and the only practical documentation I can find says thinking large is 200 clients.
thoughts, comments, ideas? solutions are best.
Thanks in advance,
Eric.
________________________________________________________________
Sent via the WebMail system at ipro.net
_______________________________________________
LARTC mailing list
LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
next reply other threads:[~2007-05-05 5:30 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-05-05 5:30 ericr [this message]
2007-05-05 6:15 ` [LARTC] Massive filtering Vladimir Vitkov
2007-05-08 18:10 ` Stanislav Kruchinin
2007-05-12 21:51 ` Corey Hickey
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200705050130.AA2025718096@ipro.net \
--to=ericr@ipro.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox