On Wed, 2007-10-31 at 14:23 -0200, Babu Skeitson wrote: > Hello everyone. > I'm thinking about implementing iptables MAC Address filtering (-m mac > --mac-source xx:xx....) in my network. > *BUT* I have a big network, with ~ 4000 internal hosts/IPs that will > be filtered via MAC, and I'm not sure about the performance of this > filtering. Are the 4000 hosts on the same network/vlan as the box running iptables? If so, you can do MAC filtering (performance shouldn't matter as the MAC address is in the link header), if not MAC filtering won't buy you much, the layer2 address will always be the same. This is essentially the difference between ARP and IP, or switching and routing if you prefer. -- Matt Zagrabelny - mzagrabe@xxxxxxxxx - (218) 726 8844 University of Minnesota Duluth Information Technology Systems & Services PGP key 1024D/84E22DA2 2005-11-07 Fingerprint: 78F9 18B3 EF58 56F5 FC85 C5CA 53E7 887F 84E2 2DA2 He is not a fool who gives up what he cannot keep to gain what he cannot lose. -Jim Elliot
Attachment:
signature.asc
Description: This is a digitally signed message part
