"iptables mark with filter fw" vs "u32 match"

Hello

Does anyone do tests to compare performance iptables marking with u32
filter ... ??

u32 filter with 4000 rules on physical interface do 99% CPU ( 2,66GHz Xeon )

4000 iptables rules with mark for fw filter do 89% CPU ( 2.66GHz Xeon )

But if i optimize iptables and make separate chains then CPU is 20% ....

Anyone has other results or tests ??

Paweł Staszewski wrote:
> Hello
>
> Does anyone do tests to compare performance iptables marking with u32
> filter ... ??
>
> u32 filter with 4000 rules on physical interface do 99% CPU ( 2,66GHz Xeon )
>
> 4000 iptables rules with mark for fw filter do 89% CPU ( 2.66GHz Xeon )
>
> But if i optimize iptables and make separate chains then CPU is 20% ....
>
> Anyone has other results or tests ??
>
>

You can classify directly with netfilter now.

Andy.

Andy Furniss wrote:

> Pawe³ Staszewski wrote:
>> Hello
>>
>> Does anyone do tests to compare performance iptables marking with u32
>> filter ... ??
>>
>> u32 filter with 4000 rules on physical interface do 99% CPU ( 2,66GHz
>> Xeon )
>>
>> 4000 iptables rules with mark for fw filter do 89% CPU ( 2.66GHz Xeon )
>>
>> But if i optimize iptables and make separate chains then CPU is 20% ....
>>
>> Anyone has other results or tests ??
>>
>>
>
> You can classify directly with netfilter now.
>
> Andy.

hmm ... Andy are You trying to say that iptables has more performance to do
classifying than u32 filters ???

Pawe³ Staszewski wrote:
> Andy Furniss wrote:
>
>
>>Pawe³ Staszewski wrote:
>>
>>>Hello
>>>
>>>Does anyone do tests to compare performance iptables marking with u32
>>>filter ... ??
>>>
>>>u32 filter with 4000 rules on physical interface do 99% CPU ( 2,66GHz
>>>Xeon )
>>>
>>>4000 iptables rules with mark for fw filter do 89% CPU ( 2.66GHz Xeon )
>>>
>>>But if i optimize iptables and make separate chains then CPU is 20% ....
>>>
>>>Anyone has other results or tests ??
>>>
>>>
>>
>>You can classify directly with netfilter now.
>>
>>Andy.
>
>
> hmm ... Andy are You trying to say that iptables has more performance to do
> classifying than u32 filters ???
>

I haven't tested, but I guess direct classify will be better than mark +
filter.

Andy.