Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 23 Aug 2007 09:40:30 -0700 (PDT)
From:      Weiguang Shi <wgshizz@yahoo.com>
To:        glebius@freebsd.org, maxim@freebsd.org
Cc:        freebsd-net@freebsd.org
Subject:   questions wrt ng_netflow
Message-ID:  <957582.10686.qm@web43133.mail.sp1.yahoo.com>

next in thread | raw e-mail | index | archive | help
Hi there,=0A=0AI've been reading netlfow.c in FreeBSD-6.2  and this piece o=
f code confuses me.=0A        484         /*=0A        485          * Go th=
rough hash and find our entry. If we encounter an=0A        486          * =
entry, that should be expired, purge it. We do a reverse=0A        487     =
     * search since most active entries are first, and most=0A        488  =
        * searches are done on most active entries.=0A        489          =
*/=0A        490         TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead,=
 fle_hash, fle1) {=0A        491                 if (bcmp(&r, &fle->f.r, si=
zeof(struct flow_rec)) =3D=3D 0)=0A        492                         brea=
k;=0A        493                 if ((INACTIVE(fle) && SMALL(fle)) || AGED(=
fle)) {=0A        494                         TAILQ_REMOVE(&hsh->head, fle,=
 fle_hash);=0A        495                         expire_flow(priv, &item, =
fle, NG_QUEUE);=0A        496                         atomic_add_32(&priv->=
info.nfinfo_act_exp, 1);=0A        497                 }=0A        498     =
    }=0A=0A    +-------------+      +--------+      +--------+      +------=
--+      +--------+=0A    | Bucket Head |----->|  RecA  |----->|  RecB  |--=
--->|  RecC  |----->|  RecD  |=0A    +-------------+      +--------+      +=
--------+      +--------+      +--------+=0A=0AIn the figure above, let's s=
ay our packet matches RecC. So before the=0Amatch, RecD is examined to see =
if it's AGED, i.e., it's lasted for too=0Along, or if it's too small and in=
active. As the match is found, the=0Acode stops searching.=0A=0AFirst, isn'=
t INACTIVE alone enough to expire a flow? Why must INACTIVE=0A_and_ SMALL?=
=0A=0ARecA and RecB would not be examined for expiration but since they are=
=0Ato the beginning of the queue and therefore actually less recently=0Aacc=
essed, they are more likely to be INACTIVE and could be more AGED.=0AI must=
 be missing something, but what justifies examining RecD but not =0ARecA an=
d RecB?=0A=0AThank you very much for your time.=0AWei=0A=0A=0A=0A=0A       =
=0A________________________________________________________________________=
____________=0ABe a better Heartthrob. Get better relationship answers from=
 someone who knows. Yahoo! Answers - Check it out. =0Ahttp://answers.yahoo.=
com/dir/?link=3Dlist&sid=3D396545433



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?957582.10686.qm>