> > If iptables would have to perform a DNS lookup everytime a packet > > passes, I think it would be terribly slow and probably not usable > > for packetfiltering. > > Actually the DNS lookup is performed only once - in the time the > ruleis inserted/appended. If the DNS returns more than one IP per > name, a number of rules is inserted with each IP returned. Yes, that's more or less what Jorge described. My point was that if the Netfilter framework had to perform a DNS lookup for each (new?) packet that it has to check, I think it would be quite slow (think about DNS query timeouts, etc) and not so usable as it is now. Grts, Rob -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
