[Bug 1127] running nft command creates lag for forwarded packets

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Thu Mar 9 14:01:34 CET 2017


--- Comment #7 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Karel Rericha from comment #6)
> Patch didnt help Pablo. Listing this small set each second from patched box:
> testbox ~ # nft list set filter private
> table ip filter {
>         set private {
>                 type ipv4_addr
>                 flags interval
>                 elements = {,,,
>         }
> }
> testbox ~ # watch -n 1 nft list set filter private > /dev/null

I guess you don't hit this problem if you just use non-interval sets.

The good solution is to provide a replacement for the interval set
implementation that we have now, which doesn't scale up as you're noticing.

I can workaround this by providing a lockless path to list. Still if you have
dynamic insertions on that interval tree, you would hit problems.

So the definitive solution is to provide a replacement implementation for
interval sets.

You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170309/0d52f8a3/attachment.html>

More information about the netfilter-buglog mailing list