Date: Thu, 29 Aug 2019 00:19:50 +0700 From: Eugene Grosbein <eugen@grosbein.net> To: Victor Gamov <vit@otcnet.ru>, freebsd-net@freebsd.org Subject: Re: finding optimal ipfw strategy Message-ID: <a6cdaeb4-5692-881a-c635-118466aeee4c@grosbein.net> In-Reply-To: <dc7df89c-f9f8-bb4f-3600-4e6bc78c6630@otcnet.ru> References: <f38b21a5-8f9f-4f60-4b27-c810f78cdc88@otcnet.ru> <4ff39c8f-341c-5d72-1b26-6558c57bff8d@grosbein.net> <a559d2bd-5218-f344-2e88-c00893272222@otcnet.ru> <ddaa55bc-1fa5-151b-258e-e3e9844802ef@yandex.ru> <c275f853-62a7-6bb7-d309-bf8a27d3dbae@grosbein.net> <f2aa4e0e-2339-d3e6-5a41-567b0c55b9e3@otcnet.ru> <eb249ea4-1f14-4826-d235-ed81e1c5e4d0@grosbein.net> <d78ccbbf-115e-d550-077c-383de805556b@otcnet.ru> <568ed3e1-caec-3988-16a5-0feea80f1630@grosbein.net> <56f81118-a584-01b4-238f-57f9d52a0fc6@otcnet.ru> <2751a318-c26b-a14d-0a18-bbd810849606@grosbein.net> <dc7df89c-f9f8-bb4f-3600-4e6bc78c6630@otcnet.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
28.08.2019 23:58, Victor Gamov wrote:
> P.S. Two questions about rules syntax optimization. What is more effective:
> skipto tablearg udp from any to table(AllMcast_out)
> or
> skipto tablearg udp from any to table(AllMcast_out) out xmit vlan*
Can't tell, this heavily depends on table contents and internal order of checks
in kernel part of ipfw but general rule should still apply: less checks, better performance.
> I hope I can place such rule at top of ruleset and only allowed multicast packets outgoing via VLANs interfaces will hit this rule.
>
> and second:
> allow udp from $src1 to { 239.1.2.55 or 239.1.2.56 }
> or
> allow udp from src1 to 239.1.2.0/24{55,56}
Last one should me much more efficient as it just needs to perform a couple of 32-bit masking operations
and previous one is more general (IP addresses may belong to different networks) and requires slower search.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?a6cdaeb4-5692-881a-c635-118466aeee4c>