* any way to reset all marked connections when using CONNMARK?
@ 2011-02-11 21:24 Chris Friesen
2011-02-12 11:42 ` Andrew Beverley
0 siblings, 1 reply; 6+ messages in thread
From: Chris Friesen @ 2011-02-11 21:24 UTC (permalink / raw)
To: netdev, netfilter-devel, netfilter, coreteam
Hi,
We've got a scenario where we want to use CONNMARK to mark connections
that have passed a large number of rules in order to allow packets from
those connections to skip rules in the future (for performance reasons).
However, when we add new rules we want to ensure that all the
connections need to pass the new rules as well.
It has been proposed to add a custom patch to clear the mark for all
marked connections--is there a better way of doing this?
I thought maybe we could use the CONNMARK as a generation count and
bumping it up each time a rule is added. This would require updating
the bypass rule each time we modify the other rules though. If there
are better options I'd like to hear them.
Thanks,
Chris
--
Chris Friesen
Software Developer
GENBAND
chris.friesen@genband.com
www.genband.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: any way to reset all marked connections when using CONNMARK?
[not found] <256863566.648.1297461959805.JavaMail.root@tahiti.vyatta.com>
@ 2011-02-11 22:11 ` Steven Kath
0 siblings, 0 replies; 6+ messages in thread
From: Steven Kath @ 2011-02-11 22:11 UTC (permalink / raw)
To: Chris Friesen; +Cc: netdev, netfilter-devel, netfilter, coreteam
----- "Chris Friesen" <chris.friesen@genband.com> wrote: -----
> We've got a scenario where we want to use CONNMARK to mark connections
> that have passed a large number of rules in order to allow packets
> from those connections to skip rules in the future (for performance
> reasons).
>
> However, when we add new rules we want to ensure that all the
> connections need to pass the new rules as well.
>
> It has been proposed to add a custom patch to clear the mark for all
> marked connections--is there a better way of doing this?
>
> I thought maybe we could use the CONNMARK as a generation count and
> bumping it up each time a rule is added. This would require updating
> the bypass rule each time we modify the other rules though. If there
> are better options I'd like to hear them.
Using conntrack-tools might help:
conntrack --update --mark 0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: any way to reset all marked connections when using CONNMARK?
2011-02-11 21:24 Chris Friesen
@ 2011-02-12 11:42 ` Andrew Beverley
2011-02-15 22:06 ` Chris Friesen
0 siblings, 1 reply; 6+ messages in thread
From: Andrew Beverley @ 2011-02-12 11:42 UTC (permalink / raw)
To: Chris Friesen; +Cc: netdev, netfilter-devel, netfilter
On Fri, 2011-02-11 at 15:24 -0600, Chris Friesen wrote:
> It has been proposed to add a custom patch to clear the mark for all
> marked connections--is there a better way of doing this?
>
How about using the conntrack userspace command-line interface?
conntrack -U -m 0
looks like it should do what you want.
Andy
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: any way to reset all marked connections when using CONNMARK?
2011-02-12 11:42 ` Andrew Beverley
@ 2011-02-15 22:06 ` Chris Friesen
2011-02-15 22:42 ` Jan Engelhardt
0 siblings, 1 reply; 6+ messages in thread
From: Chris Friesen @ 2011-02-15 22:06 UTC (permalink / raw)
To: Andrew Beverley; +Cc: netdev, netfilter-devel, netfilter
On 02/12/2011 05:42 AM, Andrew Beverley wrote:
> On Fri, 2011-02-11 at 15:24 -0600, Chris Friesen wrote:
>> It has been proposed to add a custom patch to clear the mark for all
>> marked connections--is there a better way of doing this?
>>
>
> How about using the conntrack userspace command-line interface?
>
> conntrack -U -m 0
>
> looks like it should do what you want.
Oooh, that looks perfect.
For some reason the online man pages for conntrack don't seem to be up
to date...they don't have the -U option. It's listed in the package
itself though.
Thanks,
Chris
--
Chris Friesen
Software Developer
GENBAND
chris.friesen@genband.com
www.genband.com
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: any way to reset all marked connections when using CONNMARK?
2011-02-15 22:06 ` Chris Friesen
@ 2011-02-15 22:42 ` Jan Engelhardt
2011-02-17 18:58 ` Chris Friesen
0 siblings, 1 reply; 6+ messages in thread
From: Jan Engelhardt @ 2011-02-15 22:42 UTC (permalink / raw)
To: Chris Friesen; +Cc: Andrew Beverley, netdev, netfilter-devel, netfilter
On Tuesday 2011-02-15 23:06, Chris Friesen wrote:
>On 02/12/2011 05:42 AM, Andrew Beverley wrote:
>> On Fri, 2011-02-11 at 15:24 -0600, Chris Friesen wrote:
>>> It has been proposed to add a custom patch to clear the mark for all
>>> marked connections--is there a better way of doing this?
>>>
>>
>> How about using the conntrack userspace command-line interface?
>>
>> conntrack -U -m 0
>>
>> looks like it should do what you want.
>
>Oooh, that looks perfect.
>
>For some reason the online man pages for conntrack don't seem to be up
>to date...they don't have the -U option. It's listed in the package
>itself though.
What online manpages are you referring to?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: any way to reset all marked connections when using CONNMARK?
2011-02-15 22:42 ` Jan Engelhardt
@ 2011-02-17 18:58 ` Chris Friesen
0 siblings, 0 replies; 6+ messages in thread
From: Chris Friesen @ 2011-02-17 18:58 UTC (permalink / raw)
To: Jan Engelhardt; +Cc: Andrew Beverley, netdev, netfilter-devel, netfilter
On 02/15/2011 04:42 PM, Jan Engelhardt wrote:
> On Tuesday 2011-02-15 23:06, Chris Friesen wrote:
>> For some reason the online man pages for conntrack don't seem to be up
>> to date...they don't have the -U option. It's listed in the package
>> itself though.
>
> What online manpages are you referring to?
The first google result for "man conntrack" is
http://linux.die.net/man/8/conntrack
which appears out of date. The second google result appears okay.
Chris
--
Chris Friesen
Software Developer
GENBAND
chris.friesen@genband.com
www.genband.com
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2011-02-17 18:58 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <256863566.648.1297461959805.JavaMail.root@tahiti.vyatta.com>
2011-02-11 22:11 ` any way to reset all marked connections when using CONNMARK? Steven Kath
2011-02-11 21:24 Chris Friesen
2011-02-12 11:42 ` Andrew Beverley
2011-02-15 22:06 ` Chris Friesen
2011-02-15 22:42 ` Jan Engelhardt
2011-02-17 18:58 ` Chris Friesen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).