Jan,
--On 24 January 2012 17:29:35 +0100 Jan Engelhardt <jengelh@xxxxxxxxxx>
wrote:
I have a legacy application which forwards lots of packets (router,
essentially) and uses a lot of sometimes badly written autogenerated
iptables rules (about 3,000 of them).
I am seeing on a good day high route cache efficiency. Do packets
which do not follow the slow path (i.e. cache hits) also cache
what iptables rules they hit? Nothing fancy in use bar conn_track.
Whether the route lookup was satisfied by cache or not plays no role
for Xtables execution.
Thanks. I don't suppose you know of any work on caching iptables lookups
(which I appreciate is non-trivial to impossible in the general case) or
non-linearising lookups? I am thinking of rules in the FORWARD chain which
either select by source prefix or interface (or the destination equivalent)
and if the criterion is met, jump to another rule. Currently that search in
linear (i.e. through every rule) which with a large number of
prefixes/interfaces is problematic, but with a btree or similar could be
O(log(n)), and with a hash O(1).
--
Alex Bligh
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
