Re: Extremely slow network with e1000 & ip_conntrack

Henrik Nordstrom
2003-12-11T08:26:47Z

On Thu, 11 Dec 2003, Harald Welte wrote:

> yes, this is certainly a problem - but not with conntrack, only with
> nat. So maybe we should add a safeguard, preventing
> iptables_nat/ipchains/ipfwadm from being loaded when TSO on any
> interface is enabled? Or at least print a warining in syslog?

TSO can be enabled while NAT is running so you better do this in the
packet flow or if there is a suitable notifier hook that can be used.

Most firewalls etc load the ruleset before activating the
interfaces, i..e before even loading the nic drivers, so there is no
interfaces to look at when iptables_nat is loaded.

Regards
Henrik