Netfilter and performance

["Jörg Lübbert" <j.luebbert@login-lanstation.de>]

Hello,

In an effort to optimize my rule generating script, I came to a point 
where I wonder about the internal workings of iptables and about which 
is faster and what not. Maybe you guys can help me out with the 3 
scenarios I wonder about:

First:

What is faster. Matching "-m state --state NEW" or "-m mark --mark 1" 
for every packet? Probably makes no or little difference, or?



Second in an extra chain of the mangle table:

many_matches -j MARK --set-mark i
-m mark --mark i -j RETURN
many_matches -j MARK --set-mark j
-m mark --mark j -j RETURN
more like these for an undefined number of times

or

many_matches -m mark ! --mark 0/0 -j MARK --set-mark i
many_matches -m mark ! --mark 0/0 -j MARK --set-mark j
more like these for an undefined number of times

So here we have one extra rule per match with the advantage to skip the 
rest of the rules as soon as one packet is marked vs one extra rule per 
match without the possibility to skip the rest of the matches.



And third, also in an extra chain of the mangle table:

many_matches -j CLASSIFY --set-class i:j
same_as_above_matches -j RETURN
many_matches -j CLASSIFY --set-class n:m
same_as_above_matches b match b -j RETURN
more like these for an undefined number of times

or

many_matches -j MARK --set-mark i
-m mark i -j RETURN
tc filter add ... handle i fw flowid n:m
many_matches -j MARK --set-mark j
-m mark j -j RETURN
tc filter add ... handle j fw flowid o:p
more like these for an undefined number of times



Thanks for your help

- Jörg Lübbert