Hello: I am planning to use the following MARK rule. iptables -t mangle -A POSTROUTING -d <ipaddr>/<netmask> -j MARK --set-mark <mark-id> In my application, there may be around 500 mark rules like above. They can change dynamically which means that some mark rule may be removed and new ones can be added. So at a given time there may be around 500 such rules in the system. I have the following questions on the MARK rule. It would be helpful if you could point me to the code to understand better. 01. With around 500 rules, there shall be 500 ipaddr/netmask that need to be matched for every packet. Will this be significant performance degradation?. 02. How does the matching for destination ipaddr/netmask happen? Is there an efficient hash scheme used. It would be helpful if you can point me to the code where this happens. 03. Is the skbuff->nfmark field used to store the mark value. This is available with the skbuff even at the L2 driver layer. For example ethernet-driver or anyother layer2 driver. Is my assumption correct. I very much appreciate your response. Thanks for your time, Nicholas.
