Date: Wed, 16 Aug 2017 16:08:50 +0200 From: Emmanuel Vadot <manu@bidouilliste.com> To: Gleb Smirnoff <glebius@FreeBSD.org> Cc: Emmanuel Vadot <manu@FreeBSD.org>, src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: Re: svn commit: r320944 - head/etc/rc.d Message-ID: <20170816160850.1b695e1e292f46f892301db5@bidouilliste.com> In-Reply-To: <20170815224929.GC1113@FreeBSD.org> References: <201707131340.v6DDeIE9086139@repo.freebsd.org> <20170815224929.GC1113@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Gleb, On Tue, 15 Aug 2017 15:49:29 -0700 Gleb Smirnoff <glebius@FreeBSD.org> wrote: > Emmanuel, > > On Thu, Jul 13, 2017 at 01:40:18PM +0000, Emmanuel Vadot wrote: > E> Author: manu > E> Date: Thu Jul 13 13:40:18 2017 > E> New Revision: 320944 > E> URL: https://svnweb.freebsd.org/changeset/base/320944 > E> > E> Log: > E> Add an rc.d script to setup a netflow export via ng_netflow > E> The default is to export netflow data on localhost on the netflow port. > E> ngtee is used to have the lowest overhead possible. > E> The ipfw ng hook is the netflow port (it can only be numeric) > E> Default is netflow version 5. > E> > E> Sponsored-By: Gandi.net > E> Reviewed by: bapt (earlier version), olivier (earlier version) > > It could be that using "netgraph" action instead of "ngtee" and then > returning packet back from netgraph to ipfw would show lower overhead. > However, this setup is definitely going to be less robust and more prone > to bugs in case of complex ipfw configurations. > > -- > Totus tuus, Glebius. I should have been more clear, I didn't mean that it would have less overhead in memory but in process time. Reading the source code I saw that ngtee simply m_dup the packet and then ipfw directly continue with the original one, so it seems to me that this would be the the fastest way to process packets. Could you expand on "less robust and more prone to bugs" for the "netgraph" case ? Cheers, -- Emmanuel Vadot <manu@bidouilliste.com> <manu@freebsd.org>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20170816160850.1b695e1e292f46f892301db5>