Re: MAC Hash

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




-----Original Message -----
From: Jason Cosby
Sent: 26/09/2008 8:18 AM
All,

I have the following running on our server:

for m in xx:xx:xx:xx:xx:xx...about 75 MACs
do
  iptables -t mangle -A PREROUTING -i eth1 -m mac --mac-source $m -j ACCEPT
done

iptables -t mangle -A PREROUTING -i eth1 DROP

iptables -t mangle -A PREROUTING -i eth1 -m iprange ! --src-range \
   192.168.1.1-192.168.1.74 -j DROP

and encountered a noticable slowdown when I incorporated the above. Can anyone offer suggestions as to how to speed this up? I know that hash tables are out there, but I am not clear on their use.
Thanks,
Jason
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
I would suggest the problem is your chain of 75 rules...

You may want to make some stubby user chains and branch the tests out, so packets go thru less checks.

ie 7 user chains, with 10 checks in each

so the worst case for chain traversal would be around 17 rules traversed, not 75, with an average of 8 rules, not 37....

and put your busiest mac addresses at the top of the checks if you can.

regards

b




--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux