Hello,
In an effort to optimize my rule generating script, I came to a point
where I wonder about the internal workings of iptables and about which
is faster and what not. Maybe you guys can help me out with the 3
scenarios I wonder about:
First:
What is faster. Matching "-m state --state NEW" or "-m mark --mark 1"
for every packet? Probably makes no or little difference, or?
Second in an extra chain of the mangle table:
many_matches -j MARK --set-mark i
-m mark --mark i -j RETURN
many_matches -j MARK --set-mark j
-m mark --mark j -j RETURN
more like these for an undefined number of times
or
many_matches -m mark ! --mark 0/0 -j MARK --set-mark i
many_matches -m mark ! --mark 0/0 -j MARK --set-mark j
more like these for an undefined number of times
So here we have one extra rule per match with the advantage to skip the
rest of the rules as soon as one packet is marked vs one extra rule per
match without the possibility to skip the rest of the matches.
And third, also in an extra chain of the mangle table:
many_matches -j CLASSIFY --set-class i:j
same_as_above_matches -j RETURN
many_matches -j CLASSIFY --set-class n:m
same_as_above_matches b match b -j RETURN
more like these for an undefined number of times
or
many_matches -j MARK --set-mark i
-m mark i -j RETURN
tc filter add ... handle i fw flowid n:m
many_matches -j MARK --set-mark j
-m mark j -j RETURN
tc filter add ... handle j fw flowid o:p
more like these for an undefined number of times
Thanks for your help
- Jörg Lübbert
-
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
