В Чтв, 30/04/2009 в 10:52 -0500, Susan Hinrichs пишет: > On Wed, 2009-04-29 at 11:11 +0300, Покотиленко Костик wrote: > > В Вто, 28/04/2009 в 10:39 -0500, Susan Hinrichs пишет: > > > I also agree that a runtime structure to track traffic attributes and > > > match them to targets would be great. I created my own match-tree table > > > generator to achieve a similar effect. It works, but updating large > > > static structures can be rather time consuming and fragile. > > > > Can you share details? > > > > Sure, I have a tool that takes a list of IP's, MACs, or marks, and > builds a prefix-based binary tree of the data. It generates the tree in > linked chains. It operates in bulk and incremental model. What is the purpose of this? > I didn't consider the gotos in generating the output, but I can see now > that it might simplify the tree flow quite a bit. > > I've done some very basic latency tests using ping, and the tree > introduced less than 2/3 the latency vs the a linear case for around 800 > elements, and just 20% more latency than an empty iptable policy. -- Покотиленко Костик <casper@xxxxxxxxxxxx> -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
