Re: [NEW SOFTWARE] FIRO - Iptables optimization

[Tihomir Katic <tihomir.katic@gmail.com>]

This times are per 1 command.So total time is

 {
1 MIN ( 1000 single):  0.206000 us
1 MIN ( 1000 array):  0.264000 us
1 MIN ( 1000 range):  0.182000 us
} x 1000
=
(10000 single):  206 us
(10000 array):  264 us
(10000 range):  182 us

and
{
1 MIN (10000 single):  0.081400 us
1 MIN (10000 array):  0.156900 us
1 MIN (10000 range):  0.081900 us
}  x 10000
=
(10000 single):  814 us
(10000 array):  1569 us
(10000 range):  819 us


Of course there is some noise ..., but in general 1 rule with array
list (15 single numbers) is in worst case same as 2 rules (1 single
number).
So with current implementation, 15 single ports can be generated from
2 rules (e.g. --dport 80 and --dport 101:114)

But, I must allow ranges in multiport parameter, and than this
discussion will not be needed.

Br


2011/6/9 Jan Engelhardt <jengelh@medozas.de>:
> On Thursday 2011-06-09 16:23, Tihomir Katic wrote:
>
>>>That is purely noise. You need a lot more rules (10000 and up) to
>>>measure an effect.
>>
>>I've been testing, list with 1000 rules, list with 10000 rules, list
>>with 50000 rules.
>>Searching for minimum time, in 100 tests, etc.
>>
>>1 MIN ( 1000 single):  0.206000 us
>>1 MIN (1000 array):  0.264000 us
>>
>>1 MIN (10000 single):  0.081400 us
>>1 MIN (10000 array):  0.156900 us
>
> It seems you are not executing all rules. How else could 10k rules be
> faster than 1k? You must not use any -j.
>
> What you need is something like:
>
> *filter
> :INPUT ACCEPT [0:0]
> :FORWARD ACCEPT [0:0]
> :OUTPUT ACCEPT [0:0]
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> -A INPUT -p tcp -m multiport --dport 1:5,20:25
> COMMIT
> # Completed on Thu Jun  9 16:33:15 2011
>
> (of course, replicating this to 1000 rules), and then sending yourself
> some packet and measure the RTT.
>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html