From owner-freebsd-isp Wed Nov 24 22:28: 2 1999 Delivered-To: freebsd-isp@freebsd.org Received: from complx.LF.net (complx.LF.net [212.118.160.200]) by hub.freebsd.org (Postfix) with ESMTP id DEBE814CEC for ; Wed, 24 Nov 1999 22:27:58 -0800 (PST) (envelope-from pi@complx.LF.net) Received: by complx.LF.net (Smail3.2.0.106/complx.LF.net) via LF.net GmbH Internet Services from pi for freebsd-isp@FreeBSD.ORG for host hub.FreeBSD.ORG id m11qsNn-000zzTC; Thu, 25 Nov 1999 07:27:55 +0100 (CET) Message-Id: Subject: Re: IP or packet Accounting Software for burst connections. To: freebsd-isp@FreeBSD.ORG Date: Thu, 25 Nov 1999 07:27:55 +0100 (CET) From: "Kurt Jaeger" In-Reply-To: from "Tom" at Nov 24, 1999 06:57:52 PM X-NCC-RegID: de.oberon MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Hi! > > > > I modified tcpdump to do bean, ehr, packet/byte counting. > > > That seems rather silly, since ipfw can do that already. > > My bean-count-list is roughly 3000 records large. Will ipfw scale to > > that number of rules ? For 2-3 times 34mbit/sec ? > Well, think about it, how could it be any slower? Are bpf rules more > efficient than ipfw rules since they have to be evaluated at the same > layer? Basically, bpf is pretty efficient if you use only a "get all" rule. Packet loss under 0.5 per tousand, right now. We only store them away for later/distributed processing. -- MfG/Best regards, Kurt Jaeger 21 years to go ! LF.net GmbH pi@LF.net Oberon.net GmbH pi@oberon.net Vor dem Lauch 23 fon +49 711 90074-23 Friedrich-Ebert-Str.1 D-70567 Stuttgart fax +49 711 7289041 40210 Duesseldorf fon +49 211 179253-11 For Redmond: "nuke the site from orbit -- it's the only way to be sure." To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message