Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 15 Jul 2000 08:39:32 +0200 (CEST)
From:      Luigi Rizzo <luigi@info.iet.unipi.it>
To:        Greg Skafte <skafte@worldgate.ca>
Cc:        freebsd-ipfw@FreeBSD.ORG
Subject:   Re: ipfw accounting problem? ....
Message-ID:  <200007150639.IAA24985@info.iet.unipi.it>
In-Reply-To: <396FB45F.47307416@worldgate.ca> from Greg Skafte at "Jul 14, 2000 06:46:23 pm"

next in thread | previous in thread | raw e-mail | index | archive | help
> > the way it is implemented is to account packets into the
> > dynamic rules and probably also in the "parent" rule (the one
> > with "keep-state".
> 
> 	on a 4.X machine I'm only see the accounting info in the 
> 	dynamic rules, not the Parent "keep-state". I'm just wondering
> 	if matches to the "check-state" should have accounting info?

the fact is that you can have multiple places where dynamic rules
are checked so the info you want can still be split over several
different places. Furthermore one check-state match refers to the
whole set of dynamic rules so again the info possibly logged in
the check-state rule is not that significant anyways.

> 	Some people may have issues with packet accounting being done
> 	in the dynamic rules since some of the rules can expire in as
> 	little as 5 seconds ( yes the timeout can be adjusted by a 
> 	sysctl but ..)

Well you have to consider that ipfw in general (not only dynamic rules)
was not written for accounting purposes. As an example there is no
way to read&reset a counter atomically, you must always read the whole
ruleset at once, and this requires the whole structure to
be copied at splnet(), etc. etc. -- surely this was not a problem when
rulesets were manually constructed and possibly small. Things
have changed now with dynamic rules and dynamic dummynet pipes where
you can have tens of thousands of entries in the ipfw ruleset.

	cheers
	luigi
-----------------------------------+-------------------------------------
  Luigi RIZZO, luigi@iet.unipi.it  . Dip. di Ing. dell'Informazione
  http://www.iet.unipi.it/~luigi/  . Universita` di Pisa
  TEL/FAX: +39-050-568.533/522     . via Diotisalvi 2, 56126 PISA (Italy)
  Mobile   +39-347-0373137
-----------------------------------+-------------------------------------


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-ipfw" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200007150639.IAA24985>