Re: 'swap table' feature

[Neal Murphy <neal.p.murphy@xxxxxxxxxxxx>]

On Wednesday 23 May 2012 17:53:39 Jan Engelhardt wrote:
> What, never heard of iptables-restore? Atomic replace has been in
> iptables since a long long time.

Yes, now that a few more neurons have fired, I experimented with iptables-
restore a while back.

I tested iptables-restore alongside Smoothwall/Roadster's ipbatch (custom 
libiptc interface). I don't recall the system details exactly; the kernel 
would've been around 2.6.32 and iptables would've been around 1.4.8. SWE3's 
ipbatch program was generally 5% faster than iptables-restore. Nothing to 
write home about. The bigger deal was that both programs exhibited errors when 
I applied more than 14k-25k rules without a commit. As long as there was a 
commit every 14k-25k rules, I could enter well over 250k rules; IIRC, I 
entered more than 1M rules a time or two.

Granted, not many systems have more than 14k rules. And I haven't tested newer 
versions of the software since. But I believe that 14k-25k limit was enough to 
prevent a larger table from being atomically replaced.

N
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html