Re: [PATCH 0/3] netfilter : 3 patches to boost ip_tables performance

Kyle Moffett
2005-09-23T18:01:28Z

On Sep 23, 2005, at 13:47:53, Eric Dumazet wrote:
> Harald Welte a écrit :
>> I see a contradiction in your sentence. "a new ip_tables is
>> loaded" every time a user changes a single rule. There are
>> numerous setups that dynamically change the ruleset (e.g. at
>> interface up/down point, or even think of your typical wlan
>> hotspot, where once a user is authorized, he'll get different rules.
>
> But a user changing a single rule usually calls (fork()/exec()) a
> program called iptables. The underlying cost of all this, plus
> copying the rules to user space, so that iptables change them and
> reload them in the kernel is far more important than an
> hypothetical vmalloc_node() performance problem.

Yeah, if you're really worried about the cost of iptables
manipulations, you should probably write your own happy little C
program to atomically load, update, and store the rules. Even then,
the cost of copying the whole ruleset to userspace for modification
is probably greater than that of memory allocation issues, especially
if the ruleset is large enough that memory allocation issues cause
problems :-D

Cheers,
Kyle Moffett

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCM/CS/IT/U d- s++: a18 C++++>$ UB/L/X/*++++(+)>$ P+++(++++)>$ L++++(+
++) E W++(+) N+++(++) o? K? w--- O? M++ V? PS+() PE+(-) Y+ PGP+++ t+(+
++) 5 X R? tv-(--) b++++(++) DI+ D+ G e->++++$ h!*()>++$ r !y?(-)
------END GEEK CODE BLOCK------