netdev - Re: fedora 14 kernel performance with ip forwarding workload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110406195719.GE14697@ghostprotocols.net>
Date:	Wed, 6 Apr 2011 16:57:19 -0300
From:	Arnaldo Carvalho de Melo <acme@...stprotocols.net>
To:	David Miller <davem@...emloft.net>
Cc:	jesse.brandeburg@...il.com, fedora-kernel-list@...hat.com,
	netdev@...r.kernel.org, jesse.brandeburg@...el.com
Subject: Re: fedora 14 kernel performance with ip forwarding workload

Em Wed, Apr 06, 2011 at 12:12:08PM -0700, David Miller escreveu:
> From: Jesse Brandeburg <jesse.brandeburg@...il.com>
> Date: Wed, 6 Apr 2011 11:51:06 -0700
> > perf showed netfilter being prominent, and removing it gives me much
> > higher throughput.  Is there a reason CONFIG_NETFILTER=y ?  Isn't it a
> > good thing to be able to disable netfilter if you want to?
> 
> CONFIG_NETFILTER=y is the only possible non-disabled setting, as it's
> a boolean.
> 
> All that is enabling is the hooks, and it's not possible to provide
> netfilter at all without the hooks being compiled into the kernel
> image.
> 
> Fedora by default is also probably installing several defauly
> netfilter rules, make sure to remove them.

Was there ever any attempt to try to have netfilter built-in but not
causing the performance impact?

Something like ftrace code changing when the user inserts the first
rule?

People wanting top performance disable it in the build, but thos wanting
to stick to vendor provided kernels don't have that choice :)

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html