Re: Select chain from set?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



В Чтв, 07/05/2009 в 16:01 +0200, Thomas Jacob пишет:
> On Thu, 2009-05-07 at 08:44 -0500, Susan Hinrichs wrote:
> > On Thu, 2009-05-07 at 13:07 +0300, Покотиленко Костик wrote:
> > > В Чтв, 30/04/2009 в 10:52 -0500, Susan Hinrichs пишет:
> > > > On Wed, 2009-04-29 at 11:11 +0300, Покотиленко Костик wrote:
> > > > > В Вто, 28/04/2009 в 10:39 -0500, Susan Hinrichs пишет:
> > > > > > I also agree that a runtime structure to track traffic attributes and
> > > > > > match them to targets would be great.  I created my own match-tree table
> > > > > > generator to achieve a similar effect.  It works, but updating large
> > > > > > static structures can be rather time consuming and fragile.
> > > > > 
> > > > > Can you share details?
> > > > > 
> > > > 
> > > > Sure, I have a tool that takes a list of IP's, MACs, or marks, and
> > > > builds a prefix-based binary tree of the data.  It generates the tree in
> > > > linked chains.  It operates in bulk and incremental model.
> > > 
> > > What is the purpose of this?
> > 
> > The tree lets you efficiently match a packet and do something unique for
> > each "client" or "grouping".  So set a mark or set a class ID or update
> > a unique recent set. As was noted in this thread earlier, ipset lets you
> > efficiently match a packet basic on an address, but it doesn't let you
> > do anything unique for each match. 
> 
> Nftables will let you do that in the future
> 
> http://lwn.net/Articles/324251/

This might save our world :)
I would say from the anounce this is what you have wanted from iptables.

Thanks for link.

-- 
Покотиленко Костик <casper@xxxxxxxxxxxx>

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux