iptables algorithm

[Americo Melara]

Hi,  I'm working on my thesis and need some help.  I am doing performance measurements to understand how much overhead does iptables create in the stack when processing a single packt by varying the number and type of rules, and payload size of each packet.   Some of my results show that for a TCP connection sending a single packet, it takes less time to process 10 and 40 ip addresses than 10 and 40 TCP ports and MAC addresses.  As a matter of fact, TCP ports and MAC addrss processing have the same trend, but I'm hesitant about IP.  I would like to either confirm or invalidate my results by understanding the algorithm.  I am searching through the code and trying to outline the process but I was wondering, is there any documentation that describes the algorithm(s) used for each rule?    Thank you. Americo Melara