Messages in this thread | | | From | Changli Gao <> | Date | Tue, 21 Sep 2010 08:02:43 +0800 | Subject | Re: [PATCH v5 2/2] netfilter: save the hash of the tuple in the original direction for latter use |
| |
On Tue, Sep 21, 2010 at 1:08 AM, Patrick McHardy <kaber@trash.net> wrote: > > Sure we can, dropping unconfirmed conntracks is a rare exception, > not a common case. Even under DoS we usually drop *unassured* > conntracks, which have already enterered the hash. If we're unable > to do that, we won't even allocate a new conntrack. >
Even so, saving the hash of the reply tuple isn't a good idea.
If NAT is turned on, the current code is:
mangle the reply tuple -> compute the hash of the reply tuple -> insert into the conntrack hash table.
the new code is
compute the hash of the reply tuple -> mangle the reply tuple -> recompute the hash of the reply tuple -> insert into the conntrack hash table.
As you see, the hash computing is done twice, and we use more CPU cycles than before.
-- Regards, Changli Gao(xiaosuo@gmail.com)
| |