I've been playing around with wildcard software filters and am getting very high system loads when compared to a similar number of hash filters (increases 30-50% in total system overhead). I understand that the wildcard filters should perform worse than hash-filters due to multiple checks per-rule/per-packet, but didn't expect the costs to differ so much.
I also seem to see a load that is dependent on the number of packets which match, which was surprising. I guess if a packet matches a wildcard filter (say with 0 for both port values), then it *must* have been checked against multiple hash values, versus if it fails the first test, then it would often be as cheap as simple hash filtering? Has anything changed in software filters in the last 6 months that might alleviate high wildcard filtering costs? I'm running a slightly old version of pfring --Rev: 5074. Alternatively, are there ways of doing ip-to-ip on "any-port" type packet forwarding that don't use wildcard filters. Thanks, Sunny Fugate _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
