pfilter is optimized for performance, at the expense of more complicated rulesets that have more rules but average less rules being looked at for most packets. Except for the very first packet of any connection, every other passed/accepted packet goes through exactly one iptables rule. The first rule in both the FORWARD and the INPUT chains is a rule that says "allow all packets that are part of an ongoing accepted connection through". Only initial connection attempt packets, and packets that are not going to be passed/accepted go through more than one rule. WIthout pfilter installed or turned on, every pack also goes through exactly one rule as well, the default "accept" rule at the end of every chain. So for the vast majority of packets there is no speed difference at all. I designed the compilation portion of pfilter with performance being the primary consideration.

At 07:03 PM 2/3/2003 -0500, Sean Dague wrote:
On Mon, Feb 03, 2003 at 03:06:18PM -0600, Jeremy Enos wrote:
> Holger-
> Thanks for the details on your experience... these accounts prove very
> valuable for other users.  You raise an interesting question about using
> pfilter on private networks though.  Basically, we use it on private
> networks because there hasn't ever been a recorded or reported performance
> impact by it, and there are other reasons to default to secure mode, even
> on a private subnet.

I'm surprised by that statement.  Do you have numbers for that?  I would
expect that with a network intensive program going through the iptables
layer and checking every packet would add a serious ammount of extra
overhead.

        -Sean

--
_______________________________________________________________________

Sean Dague                [EMAIL PROTECTED]               http://dague.net

There is no silver bullet.  Plus, werewolves make better neighbors than
zombies, and they tend to keep the vampire population down.
_______________________________________________________________________


-------------------------------------------------------
This SF.NET email is sponsored by:
SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See!
http://www.vasoftware.com
_______________________________________________
Oscar-users mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/oscar-users

Reply via email to