Date: Fri, 15 Sep 2006 08:21:13 -0700 From: Julian Elischer <julian@elischer.org> To: freebsd-net@freebsd.org Subject: Re: blocking a string in a packet using ipfw Message-ID: <450AC4E9.7050302@elischer.org> In-Reply-To: <200609151244.k8FCiVqV016726@lurza.secnetix.de> References: <200609151244.k8FCiVqV016726@lurza.secnetix.de>
next in thread | previous in thread | raw e-mail | index | archive | help
Oliver Fromme wrote: >Willem Jan Withagen wrote: > > Julian Elischer wrote: > > > > Forgot to mention: 4.7-PRERELEASE :( > > > > > > ugh... no tables > > > and 45000 lines will be bad. > >Not necessarily ... > > > Over that time I collected over 50.000 IP's which all ended up > > in IPFW. :) The box (PIII, 750 Mhz, 512Mb) started using a lot > > of system and interrupt time, but it survived it all. > >I once wrote a small tool that took a bunch of IP addresses >on stdin and converted it into IPFW "skipto" rules forming >a binary tree. So, in the worst case, only 32 rules had to >be checked for each packet, instead of 50,000. > > > yes I've done that too but tables are such an improvement. I back ported tabled from 4.10 to 4.8 for ironport last year and it wasn't any problem.. just copied back the relevant files and compiled with ipfw2. it would probably work for 4.7 too. >Of course, with IPFW2's table feature, that tool of mine >became obsolete. > >Best regards > Oliver > > >
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?450AC4E9.7050302>