From owner-freebsd-current Fri Jan 7 10: 2:31 2000 Delivered-To: freebsd-current@freebsd.org Received: from info.iet.unipi.it (info.iet.unipi.it [131.114.9.184]) by hub.freebsd.org (Postfix) with ESMTP id 0545D15052 for ; Fri, 7 Jan 2000 10:02:13 -0800 (PST) (envelope-from luigi@info.iet.unipi.it) Received: (from luigi@localhost) by info.iet.unipi.it (8.9.3/8.9.3) id TAA05558; Fri, 7 Jan 2000 19:02:33 +0100 (CET) (envelope-from luigi) From: Luigi Rizzo Message-Id: <200001071802.TAA05558@info.iet.unipi.it> Subject: Re: ipfw optimizations In-Reply-To: <003301bf5937$90b0c340$c80aa8c0@local.mindstep.com> from Patrick Bihan-Faou at "Jan 7, 2000 12:49:37 pm" To: Patrick Bihan-Faou Date: Fri, 7 Jan 2000 19:02:33 +0100 (CET) Cc: freebsd-current@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL61 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG > One of the things I would do to optimize ipfw is: > - instead of keeping one list with all the rules, split the list (the > internal one) by interface and by direction (one list for ed1 incoming, > one list for ed1 outgoing, etc.). one skipto rule is enough to switch between two rulesets depending on direction, so this is not really worthwhile. I agree that having a `switch' type of rule for selecting interfaces would be a reasonable gain of efficiency (but then again.. how many interfaces is one using!) The problem with current rule format is that you can detect a non-match very early, but in order to have a real match you have to test all the fields (addresses, ports, interfaces, ...) and even if this only means testing flags, it is still some 8-10 tests and 8-10 jumps. cheers luigi -----------------------------------+------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . Dip. di Ing. dell'Informazione http://www.iet.unipi.it/~luigi/ . Universita` di Pisa TEL/FAX: +39-050-568.533/522 . via Diotisalvi 2, 56126 PISA (Italy) Mobile +39-347-0373137 -----------------------------------+------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message