[lkml]   [1997]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Firewalling Rules
> I don't think you can work with has tables easily: you don't know how
> specific a rule is going to hit this packet. So you cannot generate a
> usable hash-code from a packet that just came in that will point you
> towards the right firewall rule. If all rules would specify a complete
> host, then you'd be able to make a hash based on the source IP. However
> now you've got 32 possible netmasks that might make a rule match.

You can use hashing to lookup some sort of rule-cache.
When you receive a packet belonging to a given combination of src-adress/
src-port/dst-adress/dst-port it is likely you will receive more packets
with that combination in the future. You can then create a cache entry for
that combination indexed with a hash. Each time you receive a packet you
would have to look-up this cache first. If you have a hit you would still
have to check it is not some other combination which hashes to the same

Something similair is used in routers to reduce the cost of looking up
routing rules, i think (correct me if i'm wrong :). I can imagine though
a router to have a lot more routing rules than someone is going to have
firewall rules.

Waldo Bastian

 \ /
  Last update: 2005-03-22 13:40    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean