From: Pascal Hambourg <pascal.mail@plouf.fr.eu.org>
To: netfilter@vger.kernel.org
Subject: Re: Netfilter Performance when using MAC filter
Date: Thu, 01 Nov 2007 11:05:10 +0100 [thread overview]
Message-ID: <4729A4D6.2020106@plouf.fr.eu.org> (raw)
In-Reply-To: <1193859183.5142.2.camel@grateful.d.umn.edu>
Matt Zagrabelny a écrit :
> On Wed, 2007-10-31 at 20:19 +0100, Pascal Hambourg wrote:
>
>>Matt Zagrabelny a écrit :
>>
>>>If so, you can do MAC filtering (performance shouldn't matter as the MAC
>>>address is in the link header)
>>
>>Can you please elaborate about the relationship beween filtering
>>performance and the address layer ?
>
> There is nothing to elaborate on. ;)
>
> The frame contains the MAC address. This is what iptables will be
> looking at. If the box running iptables is on the same network/vlan as
> the rest of the traffic it is expecting to filter, then it will have MAC
> addresses of actual hosts, however, if traffic is coming from a
> different network/vlan then said traffic will have been routed and the
> frame will have changed, thus the MAC address will be the MAC of the
> network boundary, namely the router/gateway.
Sorry, but I still do not see the point in "performance shouldn't matter
as the MAC address is in the link header". Performance (read : speed) is
mostly related to the number of rules, isn't it ?
next prev parent reply other threads:[~2007-11-01 10:05 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-10-31 16:23 Netfilter Performance when using MAC filter Babu Skeitson
2007-10-31 18:26 ` Matt Zagrabelny
2007-10-31 18:41 ` Grant Taylor
2007-10-31 19:19 ` Pascal Hambourg
2007-10-31 19:33 ` Matt Zagrabelny
2007-11-01 10:05 ` Pascal Hambourg [this message]
2007-11-01 13:17 ` Matt Zagrabelny
2007-11-01 14:55 ` Pascal Hambourg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4729A4D6.2020106@plouf.fr.eu.org \
--to=pascal.mail@plouf.fr.eu.org \
--cc=netfilter@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox