From mboxrd@z Thu Jan 1 00:00:00 1970 From: Benny Amorsen Subject: Re: [PATCH,RFC] Route match Date: Fri, 04 Jul 2008 15:47:56 +0200 Message-ID: References: <20080703003942.GA2012@linuxace.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii To: netfilter-devel@vger.kernel.org Return-path: Received: from main.gmane.org ([80.91.229.2]:51668 "EHLO ciao.gmane.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753516AbYGDNsH (ORCPT ); Fri, 4 Jul 2008 09:48:07 -0400 Received: from list by ciao.gmane.org with local (Exim 4.43) id 1KEldr-0007ol-UY for netfilter-devel@vger.kernel.org; Fri, 04 Jul 2008 13:48:03 +0000 Received: from hd5b9080a.c45-01-12.sta.perspektivbredband.net ([213.185.8.10]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 04 Jul 2008 13:48:03 +0000 Received: from benny+usenet by hd5b9080a.c45-01-12.sta.perspektivbredband.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 04 Jul 2008 13:48:03 +0000 Sender: netfilter-devel-owner@vger.kernel.org List-ID: Jan Engelhardt writes: > I fail to see why Xtables (not just a firewall) should be slower > than the routing table (without routing cache, to make it fair). What about the routing cache, though? Our Linux-based routers handle considerably less than 1Gbps peak, and they drop packets when the cache is flushed. (So I had to set the automatic flush to 86400 seconds instead of 10). It would be necessary to either reinvent the route cache or come up with something better. Preferably the latter, of course. /Benny