(replying by private mail) Hi, > > Thank you for pointing it out, I didn't know about conntrack support in ulogd. > > > > As far as I understood, IPFIX output in ulogd is in a early stage and > > don't work. So, I tested ulogd + ctnetlink with null output and it > > worked very well. I've done an IPFIX implementation a few months ago for ulogd2, but it currently is of prototype character only, as it only implements IPFIX over UDP, but SCTP and possibly TCP (+ SSL) are required for a conforming implementation. I use the "bi-flow" approach of RFC 51303, but it shouldn't be a problem at all to have it support the single direction flow approach instead from RFC 5101/5102. In general ctnetlink is not a problem here from a performance standpoint, and I think there is no need for doing that in kernel space. Some bits and pieces may be missing on the kernel side if you need to classify your flows though. E. g. some IPFIX Aggregrators require the DSCP value for that. > Accounting is done in kernel space by conntrack, but aggregation should > be done in userspace in my opinion. I don't think you need a lot of > optimization, AFAIK Holger's patches already scale to large setups > very well. I have setups with hundreds of thounsands of flows, and it accounts quite well :). Hope that helps a bit. /holger -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
