lkml.org 
[lkml]   [1999]   [Jun]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Q: ipchains and limitations in (accounting) rules
On Wed, 9 Jun 1999, Friedrich Lobenstock wrote:

> Frank Bernard wrote:
> >
> > I've set up a complex firewall with ipchains with more then 800 rules.
> > No performance tradeoff yet.
> >
>
> I already have 1024 accounting rules in action but in the worst case I might
> end up with about 260000. In reality I think I'll need about 2048. But
> in the worst case...

If you really plan to use this huge amount of rules, you have to
arrange them in several chains, or else your machine will be unusable
at not-too-high network loads.
I did an experiment with 65536 rules and when inserted in the same
chain one after another, even a simple ping was serious pain to the
machine - a K6-2/333). It was _much_ better when arranging them into a
256chain*256entry scheme, and it seems to do best at 4x4x4x...x4
arrangement. (I only tried this with equal chain lengths.) There's the
result of my experiment (currently only in Hungarian, but I'll
translate it to English if there's interest) at
http://dawn.elte.hu/~endre/meres/ .

greetings
endre

--
..all in all it's just another rule in the firewall.

/Ping Flood/



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:52    [W:0.050 / U:1.004 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site