From: Hans Schillstrom <hans@schillstrom•com>
To: Pablo Neira Ayuso <pablo@netfilter•org>
Cc: Hans Schillstrom <hans.schillstrom@ericsson•com>,
kaber@trash•net, jengelh@medozas•de,
netfilter-devel@vger•kernel.org, netdev@vger•kernel.org
Subject: Re: [v2 PATCH 1/2] NETFILTER module xt_hmark new target for HASH based fw
Date: Wed, 16 Nov 2011 10:28:42 +0100 [thread overview]
Message-ID: <201111161028.43078.hans@schillstrom.com> (raw)
In-Reply-To: <20111109143922.GC24174@1984>
Hello Pablo
On Wednesday, November 09, 2011 15:39:22 Pablo Neira Ayuso wrote:
> On Tue, Nov 08, 2011 at 04:12:27PM +0100, Hans Schillstrom wrote:
> > >BTW, do you have some number of this running with and without
> > >conntrack? It would be interesting to have.
> >
> > I didn't save them, but I can make a new benchmark later on.
>
> Thanks, I'm interested in them. It can be just xt_HMARK with and
> without conntrack enabled. Also make sure that you use stateful
> rule-set if conntrack is enabled (thus, resulting in hashing only
> once, not every packet). Otherwise, conntrack will not provide
> any improvement.
>
I have some problems with the generator...,
so I did some simple iperf tcp test with KVM:s i.e. standart tcp setup
iptables just one rule
-A PREROUTING -d 10.0.0.10/32 -j HMARK --hmark-mod 0x2 --hmark-offs 0x64
Some typical values shows ~8% degradation with conntrack loaded
a) Without conntrack loaded
[ 3] 0.0-10.0 sec 83.5 MBytes 70.0 Mbits/sec
b) With conntrack loaded (no iptable rules in use --ctstate or -m conntrack)
[ 3] 0.0-10.0 sec 78.0 MBytes 65.4 Mbits/sec
c) With iptables rule in use
iptables -t mangle -A PREROUTING -d 10.0.0.10 -m conntrack --ctstate NEW -j HMARK --mod 2 --offs 100
iptables -t mangle -A PREROUTING -d 10.0.0.10 -m conntrack --ctstate ESTABLISHED,RELATED -j HMARK --mod 2 --offs 100
iptables -t mangle -A PREROUTING -d 10.0.0.10 -m conntrack --ctstate INVALID -j DROP
[ 3] 0.0-10.0 sec 77.4 MBytes 64.9 Mbits/sec
A clean KVM with 3.2.0-rc1 kernel with virt-io
Module Size Used by Not tainted
nf_conntrack_ipv4 16731 1
nf_defrag_ipv4 12436 1 nf_conntrack_ipv4
xt_conntrack 12390 1
xt_hmark 12390 1
iptable_mangle 12390 1
ip_tables 20755 1 iptable_mangle
ipip 16515 0
tunnel4 12484 1 ipip
/Hans
next prev parent reply other threads:[~2011-11-16 9:28 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-11-08 15:12 Re[2]: [v2 PATCH 1/2] NETFILTER module xt_hmark new target for HASH based fw Hans Schillstrom
2011-11-09 14:39 ` Pablo Neira Ayuso
2011-11-16 9:28 ` Hans Schillstrom [this message]
2011-11-16 10:50 ` Pablo Neira Ayuso
-- strict thread matches above, loose matches on Subject: below --
2011-11-07 23:29 Re[2]: " Hans Schillstrom
2011-11-08 10:51 ` Pablo Neira Ayuso
2011-11-13 17:05 ` Pablo Neira Ayuso
2011-11-14 9:19 ` Hans Schillstrom
2011-11-14 11:38 ` Jan Engelhardt
2011-11-15 10:01 ` Pablo Neira Ayuso
2011-10-03 17:46 [v2 PATCH 0/2] NETFILTER new target module, HMARK Hans Schillstrom
2011-10-03 17:46 ` [v2 PATCH 1/2] NETFILTER module xt_hmark new target for HASH based fw Hans Schillstrom
2011-11-07 0:52 ` Pablo Neira Ayuso
2011-11-07 3:36 ` Jan Engelhardt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201111161028.43078.hans@schillstrom.com \
--to=hans@schillstrom$(echo .)com \
--cc=hans.schillstrom@ericsson$(echo .)com \
--cc=jengelh@medozas$(echo .)de \
--cc=kaber@trash$(echo .)net \
--cc=netdev@vger$(echo .)kernel.org \
--cc=netfilter-devel@vger$(echo .)kernel.org \
--cc=pablo@netfilter$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox