netdev - Optimizing tc filters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 10 Dec 2011 13:16:28 -0500
From:	"John A. Sullivan III" <jsullivan@...nsourcedevel.com>
To:	netdev@...r.kernel.org
Subject: Optimizing tc filters

Hello, all.  Given that there are several ways to direct packets into
the appropriate queue, I was wondering which ways are generally more
efficient.  There seem to be a number of email discussions but nothing
authoritative.  From those discussions, it would seem that for most
corporate usage (as in more traffic than a home user) we would have from
most efficient to least efficient:

1) Mark the connection with CONNMARK and us --restore-mark to mark all
packets in the connection for classification via an fw filter

2) Use the iptables CLASSIFY target

3) u32 filter

4) Mark individual packets and use an fw filter - one email thread says
this is more efficient than #3

Is this correct?

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html