From: Florian Westphal <fw@strlen.de>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: Florian Westphal <fw@strlen.de>,
Nicolas Dichtel <nicolas.dichtel@6wind.com>,
davem@davemloft.net, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org
Subject: Re: [PATCH net 2/2] conntrack: enable to tune gc parameters
Date: Fri, 14 Oct 2016 13:16:38 +0200 [thread overview]
Message-ID: <20161014111638.GA13022@breakpoint.cc> (raw)
In-Reply-To: <20161014105327.GA8655@salvia>
Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> I would prefer not to expose sysctl knobs, if we don't really know
> what good default values are good, then we cannot expect our users to
> know this for us.
>
> I would go tune this in a way that this resembles to the previous
> behaviour.
I do not see how this is possible without reverting to old per-conntrack
timer scheme.
With per-ct timer userspace gets notified the moment the timer
fires, without it notification comes 'when kernel detects the timeout'
which in worst case, as Nicholas describes, is when gc worker comes
along.
You can run the gc worker every jiffie of course, but thats just
wasting cpu cycles (and you still get a small delay).
I don't see a way to do run-time tuning except faster restarts when
old entries start accumulating. This is what the code tries to do,
perhaps you have a better idea for the 'next gc run' computation.
next prev parent reply other threads:[~2016-10-14 11:16 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-10 10:18 [PATCH net 0/2] conntrack update Nicolas Dichtel
2016-10-10 10:18 ` [PATCH net 1/2] conntrack: remove obsolete sysctl (nf_conntrack_events_retry_timeout) Nicolas Dichtel
2016-10-10 13:57 ` Florian Westphal
2016-10-17 15:39 ` Pablo Neira Ayuso
2016-10-10 10:18 ` [PATCH net 2/2] conntrack: enable to tune gc parameters Nicolas Dichtel
2016-10-10 14:04 ` Florian Westphal
2016-10-10 15:24 ` Nicolas Dichtel
2016-10-13 20:43 ` Florian Westphal
2016-10-14 10:12 ` Nicolas Dichtel
2016-10-14 10:37 ` Florian Westphal
2016-10-14 10:53 ` Pablo Neira Ayuso
2016-10-14 11:16 ` Florian Westphal [this message]
2016-10-18 8:30 ` [PATCH net] conntrack: perform a full scan in gc Nicolas Dichtel
2016-10-18 8:47 ` Florian Westphal
2016-10-18 10:06 ` Nicolas Dichtel
2016-10-18 12:37 ` [PATCH net] conntrack: restart gc immediately if GC_MAX_EVICTS is reached Nicolas Dichtel
2016-10-19 16:02 ` Florian Westphal
2016-10-19 16:14 ` Pablo Neira Ayuso
2016-10-20 8:50 ` [PATCH net] conntrack: perform a full scan in gc Nicolas Dichtel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161014111638.GA13022@breakpoint.cc \
--to=fw@strlen.de \
--cc=davem@davemloft.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=pablo@netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).