Re: netfilter queue throughput slowdown

[Eric Leblond <eric@regit.org>]

[-- Attachment #1: Type: text/plain, Size: 1387 bytes --]

Hello,

On Thu, 2011-06-30 at 19:45 +0200, Eric Dumazet wrote:
> Le jeudi 30 juin 2011 à 19:07 +0200, Eric Leblond a écrit :
> 
> > As the verdict failure is bound to occur in a high load time,
> > retransmission of the verdict (which is necessary) will not help the
> > system to recover. Userspace has to deal with it but it has another
> > consequences which is that userspace software may suffer of case where
> > successive failures occurs.
> > 
> > In this scope, Florian's patch "netfilter: nfqueue: batch verdict
> > support" could be really useful. It could be used by userspace to
> > trigger an decide on all stucked packets. Issuing a massive ACCEPT could
> > lead to dynosaurus packet coming from ancient time but it could be ok if
> > batch occurs enough often.
> > 
> > Is there a plan to accept it in mainstream ?
> 
> Given that apparently some apps are not aware some of their verdicts are
> lost, I consider the BATCH idea would be a bad idea, unless DROP is
> used.
> 
> If you have any doubt, only sane thing is to drop packets, not accept
> them.

All depends of the application. For a security application this is a
sane behaviour (and maybe the only one acceptable) but we've seen
applications such as NFQUEUE based QoS implementation where ACCEPT may
be a decent decision.

BR,
-- 
Eric Leblond 
Blog: http://home.regit.org/

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 198 bytes --]