From: Steven Kath <steven.kath@vyatta.com>
To: Chris Friesen <chris.friesen@genband.com>
Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
netfilter@vger.kernel.org, coreteam@netfilter.org
Subject: Re: any way to reset all marked connections when using CONNMARK?
Date: Fri, 11 Feb 2011 14:11:56 -0800 (PST) [thread overview]
Message-ID: <426866445.661.1297462316364.JavaMail.root@tahiti.vyatta.com> (raw)
In-Reply-To: <256863566.648.1297461959805.JavaMail.root@tahiti.vyatta.com>
----- "Chris Friesen" <chris.friesen@genband.com> wrote: -----
> We've got a scenario where we want to use CONNMARK to mark connections
> that have passed a large number of rules in order to allow packets
> from those connections to skip rules in the future (for performance
> reasons).
>
> However, when we add new rules we want to ensure that all the
> connections need to pass the new rules as well.
>
> It has been proposed to add a custom patch to clear the mark for all
> marked connections--is there a better way of doing this?
>
> I thought maybe we could use the CONNMARK as a generation count and
> bumping it up each time a rule is added. This would require updating
> the bypass rule each time we modify the other rules though. If there
> are better options I'd like to hear them.
Using conntrack-tools might help:
conntrack --update --mark 0
next parent reply other threads:[~2011-02-11 22:11 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <256863566.648.1297461959805.JavaMail.root@tahiti.vyatta.com>
2011-02-11 22:11 ` Steven Kath [this message]
2011-02-11 21:24 any way to reset all marked connections when using CONNMARK? Chris Friesen
2011-02-12 11:42 ` Andrew Beverley
2011-02-15 22:06 ` Chris Friesen
2011-02-15 22:42 ` Jan Engelhardt
2011-02-17 18:58 ` Chris Friesen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=426866445.661.1297462316364.JavaMail.root@tahiti.vyatta.com \
--to=steven.kath@vyatta.com \
--cc=chris.friesen@genband.com \
--cc=coreteam@netfilter.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).