Jan Engelhardt wrote:
(whew, don't strip Ccs!)
On Tuesday 2009-03-10 20:19, Chris Hanson wrote:
A suggestion for the match recent part of netfilter. Include a
life_span field in the table. A host is removed from a table after
it hasn't been seen for x seconds.
How does this differ from simply ignoring hosts recorded in the list
whose last_seen time is greater than x -- apart from potential
memory savings?
I had the impression that the --set function behaved badly when the table
filled up.
Well the “only” problem xt_recent has is that entries are thrown off
the edge of the table when it fills up. It *should* do this in the
style of an LRU. The only benefit of a premature removal due to
life_span exceeding I can see is that you want to expire specific
entries (i.e. matched by, like, -m moonphase) to specifically keep
even older entries from falling off the LRU edge.
Seems to be a big plan there.</thoughts>
That is a big plan, and not worth the bother!
I double checked the behavior of the table when full and it seemed to
work just fine. I don't know why I thought it was broken.
I also believe that the "--rcheck ! --seconds x" check didn't work.
I will investigate and report back.
I made a mistake in the syntax. It should be "! --rcheck --seconds x".
So, in the end, all I have to complain about is that "--rcheck !
--seconds x" doesn't throw an error. It is accepted as if there was no "!".
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
