On Mon, 2003-03-10 at 20:04, Rinse Kloek wrote: > We use a RedHat 7.3 machine as bridge on a P3 1.8 Ghz with 2 64 bits > Gigabit interfaces. On the machine we have a lot of iptables rules like : > all -- 213.134.x.0 0.0.0.0/0 > all -- 0.0.0.0/0 213.134.x.0 > TOS all -- 213.134.x.4 0.0.0.0/0 TOS set 0x08 > all -- 0.0.0.0/0 213.134.x.4 > > We have about 3200 iptables rules on our bridge. I've tested today to > remove 1000 of these rules. The load dropped from about 40% to 25%. So I > think the iptables rule take up the most of the CPU load. Do you think this > is a problem of ineffeciency of iptables or just a 'limitation' in the > TCP/IP stack of linux ? > Probably the packet parser having a hard time trying to make sense of that many rules ... > regards Rinse -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ( Raymond Leach ) ) Knowledge Factory ( ( ) ) Tel: +27 11 445 8100 ( ( Fax: +27 11 445 8101 ) ) ( ( http://www.knowledgefactory.co.za/ ) ) http://www.saptg.co.za/ ( ( http://www.mapnet.co.za/ ) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ o o o o .--. .--. | o_o| |o_o | | \_:| |:_/ | / / \\ // \ \ ( | |) (| | ) /`\_ _/'\ /'\_ _/`\ \___)=(___/ \___)=(___/
Attachment:
signature.asc
Description: This is a digitally signed message part
