Re: MAC Hash

[Brian Austin - Standardknit <brian@standarduniversal.com.au>]

-----Original Message -----
 From: Jason Cosby
 Sent: 26/09/2008 8:18 AM
> All,
>
> I have the following running on our server:
>
> for m in xx:xx:xx:xx:xx:xx...about 75 MACs
> do
>   iptables -t mangle -A PREROUTING -i eth1 -m mac --mac-source $m -j ACCEPT
> done
>
> iptables -t mangle -A PREROUTING -i eth1 DROP
>
> iptables -t mangle -A PREROUTING -i eth1 -m iprange ! --src-range \
>    192.168.1.1-192.168.1.74 -j DROP
>
> and encountered a noticable slowdown when I incorporated the above. Can anyone offer suggestions as to how to speed this up? I know that hash tables are out there, but I am not clear on their use. 
>
> Thanks,
> Jason
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>   
I would suggest the problem is your chain of 75 rules...

You may want to make some stubby user chains and branch the tests out, 
so packets go thru less checks.

ie 7 user chains, with 10 checks in each

so the worst case for chain traversal would be around 17 rules 
traversed, not 75, with an average of 8 rules, not 37....

and put your busiest mac addresses at the top of the checks if you can.

regards

b