[lkml]   [1997]   [Nov]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Firewalling Rules
    > I don't think you can work with has tables easily: you don't know how
    > specific a rule is going to hit this packet. So you cannot generate a
    > usable hash-code from a packet that just came in that will point you
    > towards the right firewall rule. If all rules would specify a complete
    > host, then you'd be able to make a hash based on the source IP. However
    > now you've got 32 possible netmasks that might make a rule match.

    You can use hashing to lookup some sort of rule-cache.
    When you receive a packet belonging to a given combination of src-adress/
    src-port/dst-adress/dst-port it is likely you will receive more packets
    with that combination in the future. You can then create a cache entry for
    that combination indexed with a hash. Each time you receive a packet you
    would have to look-up this cache first. If you have a hit you would still
    have to check it is not some other combination which hashes to the same

    Something similair is used in routers to reduce the cost of looking up
    routing rules, i think (correct me if i'm wrong :). I can imagine though
    a router to have a lot more routing rules than someone is going to have
    firewall rules.

    Waldo Bastian

     \ /
      Last update: 2005-03-22 13:40    [W:0.017 / U:16.204 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site