Phil Sutter <phil@xxxxxx> wrote: > The following two patches improve packet throughput in a test setup > sending UDP packets (using iperf3) between two netns. The ruleset used > on receiver side is like this: > > | *filter > | :test - [0:0] > | -A INPUT -j test > | -A INPUT -j ACCEPT > | -A test ! -s 10.0.0.0/10 -j DROP # this line repeats 10000 times > | COMMIT > > These are the generated VM instructions for each rule: > > | [ payload load 4b @ network header + 12 => reg 1 ] > | [ bitwise reg 1 = (reg=1 & 0x0000c0ff ) ^ 0x00000000 ] Not related to this patch, but we should avoid the bitop if the netmask is divisble by 8 (can adjust the cmp -- adjusting the payload expr is probably not worth it). > | [ cmp eq reg 1 0x0000000a ] > | [ counter pkts 0 bytes 0 ] Out of curiosity, does omitting 'counter' help? nft counter is rather expensive due to bh disable, iptables does it once at the evaluation loop only.
