From owner-freebsd-net@FreeBSD.ORG Thu Aug 23 17:07:11 2007 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 6901D16A421 for ; Thu, 23 Aug 2007 17:07:11 +0000 (UTC) (envelope-from wgshizz@yahoo.com) Received: from web43133.mail.sp1.yahoo.com (web43133.mail.sp1.yahoo.com [216.252.121.63]) by mx1.freebsd.org (Postfix) with SMTP id 4C68F13C4CB for ; Thu, 23 Aug 2007 17:07:11 +0000 (UTC) (envelope-from wgshizz@yahoo.com) Received: (qmail 10744 invoked by uid 60001); 23 Aug 2007 16:40:31 -0000 DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding:Message-ID; b=6HUO84hO4jSGiELwcmqu84WOfSKMucacwCH0hLmEpUU5RI1OGykLOMH/JhF9RhGRjQtWzgP5bUUx9I5y6E356xP59lonwlSgDheLVmWDWHvbRSHXr2tE/AQK7ANIKr+n1to1i1paOdKSZ/3Hl/d1pjt6ogY4b3ZPRiZIWk27fZ4=; X-YMail-OSG: yL1dUucVM1njVrsvPf7ILR4hetPuPc.EF4SUEhliXMZwrDYJ_pdx6tb2uVLsT72Qow-- Received: from [69.147.84.254] by web43133.mail.sp1.yahoo.com via HTTP; Thu, 23 Aug 2007 09:40:30 PDT X-Mailer: YahooMailRC/651.48 YahooMailWebService/0.7.134 Date: Thu, 23 Aug 2007 09:40:30 -0700 (PDT) From: Weiguang Shi To: glebius@freebsd.org, maxim@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Message-ID: <957582.10686.qm@web43133.mail.sp1.yahoo.com> Cc: freebsd-net@freebsd.org Subject: questions wrt ng_netflow X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Aug 2007 17:07:11 -0000 Hi there,=0A=0AI've been reading netlfow.c in FreeBSD-6.2 and this piece o= f code confuses me.=0A 484 /*=0A 485 * Go th= rough hash and find our entry. If we encounter an=0A 486 * = entry, that should be expired, purge it. We do a reverse=0A 487 = * search since most active entries are first, and most=0A 488 = * searches are done on most active entries.=0A 489 = */=0A 490 TAILQ_FOREACH_REVERSE_SAFE(fle, &hsh->head, fhead,= fle_hash, fle1) {=0A 491 if (bcmp(&r, &fle->f.r, si= zeof(struct flow_rec)) =3D=3D 0)=0A 492 brea= k;=0A 493 if ((INACTIVE(fle) && SMALL(fle)) || AGED(= fle)) {=0A 494 TAILQ_REMOVE(&hsh->head, fle,= fle_hash);=0A 495 expire_flow(priv, &item, = fle, NG_QUEUE);=0A 496 atomic_add_32(&priv->= info.nfinfo_act_exp, 1);=0A 497 }=0A 498 = }=0A=0A +-------------+ +--------+ +--------+ +------= --+ +--------+=0A | Bucket Head |----->| RecA |----->| RecB |--= --->| RecC |----->| RecD |=0A +-------------+ +--------+ += --------+ +--------+ +--------+=0A=0AIn the figure above, let's s= ay our packet matches RecC. So before the=0Amatch, RecD is examined to see = if it's AGED, i.e., it's lasted for too=0Along, or if it's too small and in= active. As the match is found, the=0Acode stops searching.=0A=0AFirst, isn'= t INACTIVE alone enough to expire a flow? Why must INACTIVE=0A_and_ SMALL?= =0A=0ARecA and RecB would not be examined for expiration but since they are= =0Ato the beginning of the queue and therefore actually less recently=0Aacc= essed, they are more likely to be INACTIVE and could be more AGED.=0AI must= be missing something, but what justifies examining RecD but not =0ARecA an= d RecB?=0A=0AThank you very much for your time.=0AWei=0A=0A=0A=0A=0A = =0A________________________________________________________________________= ____________=0ABe a better Heartthrob. Get better relationship answers from= someone who knows. Yahoo! Answers - Check it out. =0Ahttp://answers.yahoo.= com/dir/?link=3Dlist&sid=3D396545433