On Thu, 2009-05-07 at 16:01 +0200, Thomas Jacob wrote: > On Thu, 2009-05-07 at 08:44 -0500, Susan Hinrichs wrote: > > On Thu, 2009-05-07 at 13:07 +0300, Покотиленко Костик wrote: > > > В Чтв, 30/04/2009 в 10:52 -0500, Susan Hinrichs пишет: > > > > On Wed, 2009-04-29 at 11:11 +0300, Покотиленко Костик wrote: > > > > > В Вто, 28/04/2009 в 10:39 -0500, Susan Hinrichs пишет: > > > > > > I also agree that a runtime structure to track traffic attributes and > > > > > > match them to targets would be great. I created my own match-tree table > > > > > > generator to achieve a similar effect. It works, but updating large > > > > > > static structures can be rather time consuming and fragile. > > > > > > > > > > Can you share details? > > > > > > > > > > > > > Sure, I have a tool that takes a list of IP's, MACs, or marks, and > > > > builds a prefix-based binary tree of the data. It generates the tree in > > > > linked chains. It operates in bulk and incremental model. > > > > > > What is the purpose of this? > > > > The tree lets you efficiently match a packet and do something unique for > > each "client" or "grouping". So set a mark or set a class ID or update > > a unique recent set. As was noted in this thread earlier, ipset lets you > > efficiently match a packet basic on an address, but it doesn't let you > > do anything unique for each match. > > Nftables will let you do that in the future > > http://lwn.net/Articles/324251/ > Great! Looking forward to it. The dictionaries look great. I'll have to start playing with the first version on a test machine. Do you know what kind of MAC address support there is? Similar to the source mac support in iptables? -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
