Links to projects using netfilter

Links to projects using netfilter

[Alessandro Vesely]

Hi all!

The NFQUEUE target is documented as "passing packets to userspace". 
However, I couldn't find a list of programs that can be used for this 
purpose on netfilter.org. Thus, I had to roll my own one (I'm now 
running my first alpha release.)

Would it make sense to add projects using the QUEUE mechanism to, say, 
http://www.netfilter.org/links.html? IPQ BDB maps an IP Queue to a 
Berkeley DB indexed on the ipv4 field. More at 
https://savannah.nongnu.org/projects/ipqbdb/

Ciao
Ale

Re: Links to projects using netfilter

[Nick]

Alessandro Vesely пишет:
> Hi all!
>
> The NFQUEUE target is documented as "passing packets to userspace". 
> However, I couldn't find a list of programs that can be used for this 
> purpose on netfilter.org. Thus, I had to roll my own one (I'm now 
> running my first alpha release.)
>
> Would it make sense to add projects using the QUEUE mechanism to, say, 
> http://www.netfilter.org/links.html? IPQ BDB maps an IP Queue to a 
> Berkeley DB indexed on the ipv4 field. More at 
> https://savannah.nongnu.org/projects/ipqbdb/
>
> Ciao
> Ale
> -- 
> To unsubscribe from this list: send the line "unsubscribe netfilter" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
The NFQUEUE target is nice feature. I using perl ( module ) for inspect 
and acounting network traffic, but perl script works slow. If the 
bandwidth of more than 2MBit/s, the cpu loading is 50% (C2D E6550).
Here is a program written in C, works much faster and less weight CPU 1-2%.

Re: Links to projects using netfilter

[Alessandro Vesely]

Nick wrote:
> Alessandro Vesely пишет:
>> IPQ BDB maps an IP Queue to a Berkeley DB indexed on the ipv4
>> field. More at https://savannah.nongnu.org/projects/ipqbdb/
>>
> The NFQUEUE target is nice feature. I using perl ( module ) for inspect 
> and accounting network traffic, but perl script works slow. If the 
> bandwidth of more than 2MBit/s, the cpu loading is 50% (C2D E6550).
> Here is a program written in C, works much faster and less weight CPU 1-2%.

Besides being written in C, using BDB makes it very fast. On the 5th 
day I had 9140 records and the following /top/ output
PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  SWAP   CODE DATA COMMAND
15   0 10376 1308 1172 S    0  0.0   0:02.05 9068   16  252 ipqbdbd
18   0  9500 1312 1152 S    0  0.0   0:31.78 8188   32  256 ibd-parse

The second line above is a daemon that applies 5 pcre expressions to 
each mail.log line, in order to catch attackers: it consumes 15+ times 
more than issuing verdicts (both configured for a single queue.)

Re: Links to projects using netfilter

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 1544 bytes --]

Hi,

Le samedi 27 décembre 2008 à 12:43 +0100, Alessandro Vesely a écrit :
> Nick wrote:
> > Alessandro Vesely пишет:
> >> IPQ BDB maps an IP Queue to a Berkeley DB indexed on the ipv4
> >> field. More at https://savannah.nongnu.org/projects/ipqbdb/
> >>
> > The NFQUEUE target is nice feature. I using perl ( module ) for inspect 
> > and accounting network traffic, but perl script works slow. If the 
> > bandwidth of more than 2MBit/s, the cpu loading is 50% (C2D E6550).
> > Here is a program written in C, works much faster and less weight CPU 1-2%.
> 
> Besides being written in C, using BDB makes it very fast. On the 5th 
> day I had 9140 records and the following /top/ output
> PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  SWAP   CODE DATA COMMAND
> 15   0 10376 1308 1172 S    0  0.0   0:02.05 9068   16  252 ipqbdbd
> 18   0  9500 1312 1152 S    0  0.0   0:31.78 8188   32  256 ibd-parse
> 
> The second line above is a daemon that applies 5 pcre expressions to 
> each mail.log line, in order to catch attackers: it consumes 15+ times 
> more than issuing verdicts (both configured for a single queue.)

Hmmm, I'm a real fan of NFQUEUE but using ipset seems quiet a good idea
for your application. Your case is even one of the use example given by
Jozsef Kadlecsik in his speech:
	http://nfws.inl.fr/nfws_userday/Jozsef-Kadlecsik_IPset.pdf

Why did you choose a NFQUEUE based code instead of ipset ?

BR,
-- 
Éric Leblond <eric@inl.fr>
INL, http://www.inl.fr/
NuFW, http://www.nufw.org

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 197 bytes --]