(whew, don't strip Ccs!) On Tuesday 2009-03-10 20:19, Chris Hanson wrote: >> >>> A suggestion for the match recent part of netfilter. Include a >>> life_span field in the table. A host is removed from a table after >>> it hasn't been seen for x seconds. >> >> How does this differ from simply ignoring hosts recorded in the list >> whose last_seen time is greater than x -- apart from potential >> memory savings? > > I had the impression that the --set function behaved badly when the table > filled up. Well the “only” problem xt_recent has is that entries are thrown off the edge of the table when it fills up. It *should* do this in the style of an LRU. The only benefit of a premature removal due to life_span exceeding I can see is that you want to expire specific entries (i.e. matched by, like, -m moonphase) to specifically keep even older entries from falling off the LRU edge. Seems to be a big plan there.</thoughts> > I also believe that the "--rcheck ! --seconds x" check didn't work. > > I will investigate and report back. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
