[lkml]   [2005]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Subject[ANNOUNCE] Release of nf-HiPAC 0.9.0

    I am happy to announce the release of nf-HiPAC version 0.9.0

    During the development of version 0.9.0 everything was ported to Linux kernel
    2.6 and large parts of the kernel code have been rewritten.
    The kernel patch is now fairly non-intrusive: it only adds one simple function
    to ip_tables.c. The rest of the patch introduces new files to the kernel.
    The new release fixes all known bugs and also introduces some new features.

    Since the last release I have become part of MARA Systems AB
    ( ). MARA Systems AB is now the commercial backer
    of the HiPAC Project and finances it completely. Together MARA Systems and I
    will make sure that HiPAC is actively maintained and further developed under
    the GNU GPL.

    For all of you who don't know nf-HiPAC yet, here is a short overview:

    nf-HiPAC is a full featured packet filter for Linux which demonstrates the
    power and flexibility of HiPAC. HiPAC is a novel framework for packet
    classification which uses an advanced algorithm to reduce the number of
    memory lookups per packet. It is ideal for environments involving large rule
    sets and/or high bandwidth networks.

    nf-HiPAC provides the same rich feature set as iptables, the popular Linux
    packet filter. The complexity of the sophisticated HiPAC packet
    classification algorithm is hidden behind an iptables compatible user
    interface which renders nf-HiPAC a drop-in replacement for iptables. Thereby,
    the iptables' semantics of the rules is preserved, i.e. you can construct your
    rules like you are used to. From a user's point of view there is no need to
    understand anything about the HiPAC algorithm.

    The nf-hipac user space tool is designed to be as compatible as possible to
    'iptables -t filter'. It even supports the full power of iptables targets,
    matches and stateful packet filtering (connection tracking) besides the native
    nf-HiPAC matches. This makes a switch from iptables to nf-HiPAC very easy.
    Usually it is sufficient to replace the calls to iptables with calls to
    nf-hipac for your filter rules.

    Why another packet filter?
    iptables, like most packet filters, uses a simple packet classification
    algorithm which traverses the rules in a chain linearly per packet until a
    matching rule is found (or not). Clearly, this approach lacks efficiency.
    As networks grow more and more complex and offer a wider bandwidth linear
    packet filtering is no longer an option if many rules have to be matched
    per packet. Higher bandwidth means more packets per second which leads to
    shorter process times per packet. nf-HiPAC outperforms iptables regardless
    of the number of rules, i.e. the HiPAC classification engine does not
    impose any overhead even for very small rule sets.

    Scalability to large rule sets:
    The performance of nf-HiPAC is nearly independent of the number of rules.
    nf-HiPAC with thousands of rules still outperforms iptables with 20 rules.

    Dynamic rule sets:
    nf-HiPAC offers fast dynamic rules et updates without stalling packet
    classification in contrast to iptables which yields bad update performance
    along with stalled packet processing during updates.

    More information about the project can be found at:
    The releases are published on:

    | Michael Bellion |
    | <> |
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-09-26 04:55    [W:0.023 / U:4.624 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site