Sunny we have not done much on filters recently. Can you please send us the list of filters you're using, to see if there's a bug on our system? We appreciate if you can file a bug on https://bugzilla.ntop.org
Thanks Luca On Jun 4, 2012, at 11:17 PM, Sunny Fugate wrote: > I've been playing around with wildcard software filters and am getting very > high system loads when compared to a similar number of hash filters > (increases 30-50% in total system overhead). I understand that the wildcard > filters should perform worse than hash-filters due to multiple checks > per-rule/per-packet, but didn't expect the costs to differ so much. > > I also seem to see a load that is dependent on the number of packets which > match, which was surprising. I guess if a packet matches a wildcard filter > (say with 0 for both port values), then it *must* have been checked against > multiple hash values, versus if it fails the first test, then it would often > be as cheap as simple hash filtering? > > Has anything changed in software filters in the last 6 months that might > alleviate high wildcard filtering costs? I'm running a slightly old version > of pfring --Rev: 5074. > > Alternatively, are there ways of doing ip-to-ip on "any-port" type packet > forwarding that don't use wildcard filters. > > > Thanks, > > Sunny Fugate > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
