On Mon, Sep 19, 2016 at 10:56:14PM +0200, Daniel Mack wrote: [...] > Why would we artificially limit the use-cases of this implementation if > the way it stands, both filtering and introspection are possible?
Why should we place infrastructure in the kernel to filter packets so late, and why at postrouting btw, when we can do this way earlier before any packet is actually sent? No performance impact, no need for skbuff allocation and *no cycles wasted to evaluate if every packet is wanted or not*.
