On Tue, Feb 02, 2016 at 12:18:58AM +0100, Florian Westphal wrote: > Replacement for iptables -m statistic 'random' mode. > I added it to meta match even though its not directly related to an skb > member. We already have cpu match which isn't related to skb either and > adding a new expression just for this seemed overkill. > > If you'd rather like a new prandom expression just let me know and > I can rework it. > > There is also a libnftnl patch but its only so that debug output > displays 'meta prandom' rather than 'meta unknown'. > > Result after several minutes of constant flooding: > > counter packets 2961796882 bytes 248790938088 > meta random <= 0.900000000 counter packets 2665649546 bytes 223914561864 > meta random <= 0.500000000 counter packets 1480856860 bytes 124391976240 > meta random <= 0.100000000 counter packets 296190072 bytes 24879966048 > meta random <= 0.010000000 counter packets 29618610 bytes 2487963240 > meta random <= 0.001000000 counter packets 2963660 bytes 248947440 > meta random <= 0.000100000 counter packets 295486 bytes 24820824 > meta random <= 0.000010000 counter packets 29450 bytes 2473800 > meta random <= 0.000001000 counter packets 2911 bytes 244524 > meta random <= 0.000000100 counter packets 267 bytes 22428 > meta random <= 0.000000010 counter packets 26 bytes 2184 > meta random <= 0.000000001 counter packets 4 bytes 336 > > ... so it seems to work as intended. > > Let me know if you spot any issues with current approach. > > Kernel part only does '*dest = prandom_u32()', I'll submit it once > I know that this approach is deemed sane. Fine with me. I also started a patch to add nth and jhash support, but it's incomplete. Laura (she's on Cc) also wanted to have these for her work on modeling load balancer schedulers with nft. Thanks. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
