From owner-freebsd-net@FreeBSD.ORG  Tue Jan 27 22:34:08 2015
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 146E0FD7
 for <freebsd-net@freebsd.org>; Tue, 27 Jan 2015 22:34:08 +0000 (UTC)
Received: from onelab2.iet.unipi.it (onelab2.iet.unipi.it [131.114.59.238])
 by mx1.freebsd.org (Postfix) with ESMTP id C9BEE693
 for <freebsd-net@freebsd.org>; Tue, 27 Jan 2015 22:34:07 +0000 (UTC)
Received: by onelab2.iet.unipi.it (Postfix, from userid 275)
 id 4EED57300A; Tue, 27 Jan 2015 23:39:17 +0100 (CET)
Date: Tue, 27 Jan 2015 23:39:17 +0100
From: Luigi Rizzo <rizzo@iet.unipi.it>
To: Antoine Beaupr? <anarcat@koumbit.org>
Subject: Re: is polling still a thing?
Message-ID: <20150127223917.GA21883@onelab2.iet.unipi.it>
References: <871tmgceup.fsf@marcos.anarc.at>
 <1422384769.867067950.y2iiuu53@frv34.fwdcdn.com>
 <87pp9zc1wk.fsf@marcos.anarc.at>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <87pp9zc1wk.fsf@marcos.anarc.at>
User-Agent: Mutt/1.5.20 (2009-06-14)
Cc: freebsd-net@freebsd.org, wishmaster <artemrts@ukr.net>
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.18-1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net/>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Jan 2015 22:34:08 -0000

On Tue, Jan 27, 2015 at 05:08:27PM -0500, Antoine Beaupr? wrote:
> On 2015-01-27 13:57:20, wishmaster wrote:
> > Have you consider to use netmap-based ipfw instead pf in DDoS mitigation? I think you should. And without any network ''haks'' like polling.
> 
> My understanding of netmap was that it wasn't useful for packet
> forwarding, because its design is for transmitting packets directly to
> userland faster, whereas routers dataflow stay mostly in the router...

i think the suggestion was to have let netmap-ipfw
drop the traffic you don't want to deal with, and then
inject the remaining ones into the kernel where
the processing occurs -- possibly even using pf or
a different firewall

There are people using netmap-ipfw on external physical
boxes exactly in this way -- as a "bump in the wire",
but it is trivial to run it on the same machine.

cheers
luigi

> I'm hesitant in switching back to ipfw, considering how nice the
> featureset and syntax of pf is. But if that's what's needed to restore
> sanity...
> 
> a.
> 
> -- 
> Celui qui sait jouir du peu qu'il a est toujours assez riche.
>                          - Démocrite
> _______________________________________________
> freebsd-net@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"