Traffic accounting over ULOG inefficient?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

Since all of the other traffic accounting implementations I have met right now 
are inflexible, I decided to write my own one. There are some 
implementations, that parse the byte counters displayed by iptables and feed 
their traffic databases by this output. A dirty hack in my opinion. Something 
that knows about traffic instantly is just better .. so ULOG is a bit more 
interesting.

The only thing that disturbs me: Just for counting packet lengths queue whole 
packets to userspace? That sounds pretty inefficient to me. Why go to such 
lengths, if the netfilter kernel code itself already has a way of keeping 
track of packet lengths? Since the computer I intend to use this accounter on 
is connected with a 100Mbit NIC I guess something like that would eat up a 
good chunk of CPU time when there's much traffic to be processed.

I am still inexperienced with kernel programming, I would be grateful for any 
pointers or hints on how to achieve this "real time traffic tracking" without 
either having to read out any iptable counters every 10 minutes or queue 
entire packets to userspace.
Would a small kernel module do the trick?

- -- 
Thilo Schulz

My public PGP key is available at http://home.bawue.de/~arny/public_key.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAyKLaZx4hBtWQhl4RArdBAKDhJx2PsIMp9RqtQvKjJGShKWW9GwCeNfZf
MWmMffdTQZYcXNP51NtL5js=
=wrkr
-----END PGP SIGNATURE-----



[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux