On Wed, 9 Apr 2008, Jan Engelhardt wrote: > On Wednesday 2008-04-09 21:17, Gilad Benjamini wrote: > > >True, but I am looking for a more optimized solution > > I assume ipset's iptree is smart enough to do short-circuiting > if you have /24, /16 or /8 networks. If you have got whole networks (/n), then ipset is smart enough to handle it (nethash type). If you have got ranges, then iptreemap type is the best choice. Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : KFKI Research Institute for Particle and Nuclear Physics H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
