Re: ipset hash:net,iface - can not add more than 64 interfaces

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Thank you for the suggestion. Will benchmark in my conditions.

вт, 28 нояб. 2023 г. в 12:06, Fatih USTA <fatihusta86@xxxxxxxxx>:
>
> You can use type of list. Separate 64 elements per set. After that append into list.
>
> ipset create dummy_ifaces list:set
>
> ipset create dummy0_0 hash:net,iface
> ipset create dummy0_1 hash:net,iface
> ipset create dummy0_2 hash:net,iface
>
> ipset add dummy_ifaces dummy0_0
> ipset add dummy_ifaces dummy0_1
> ipset add dummy_ifaces dummy0_2
>
>
> On Tue, Nov 28, 2023, 12:34 Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxx> wrote:
>>
>> On Tue, 28 Nov 2023, Марк Коренберг wrote:
>>
>> > Actually, I need an ipset that matches against list of interfaces
>> > (without networks associated). Are there any ways ?
>>
>> No, that's not possible in ipset either.
>>
>> However, I'd suggest you to explore nftables where there are no such
>> internal limitation than in ipset, supports matching interface indices or
>> names and can store just interface names/indices in an nftables set too.
>>
>> Best regards,
>> Jozsef
>> > вт, 28 нояб. 2023 г. в 09:48, Jozsef Kadlecsik <kadlec@xxxxxxxxxxxxx>:
>> > >
>> > > Hi,
>> > >
>> > > On Tue, 28 Nov 2023, Марк Коренберг wrote:
>> > >
>> > > > for i in `seq 0 70`; do ip link del dummy$i; done;
>> > > > for i in `seq 0 70`; do ip link add type dummy; done;
>> > > > for i in `seq 0 70`; do ipset add qwe 0.0.0.0/0,dummy$i; done;
>> > > >
>> > > > Reveals the problem. Only 64 records can be added, but there are no
>> > > > obvious restrictions on that. I s it possible to increase the limit ?
>> > >
>> > > It is intentional. Such elements can be stored in the same hash bucket
>> > > only and 64 is the max size I'm willing to sacrifice for that. Please
>> > > note, that's a huge number and means linear evaluation, i.e. loosing
>> > > performance.
>> > >
>> > > Best regards,
>> > > Jozsef
>> > > --
>> > > E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx
>> > > PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
>> > > Address : Wigner Research Centre for Physics
>> > >           H-1525 Budapest 114, POB. 49, Hungary
>> >
>> >
>> >
>> > --
>> > Segmentation fault
>> >
>>
>> --
>> E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxx
>> PGP key : https://wigner.hu/~kadlec/pgp_public_key.txt
>> Address : Wigner Research Centre for Physics
>>           H-1525 Budapest 114, POB. 49, Hungary



-- 
Segmentation fault





[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux