Date: Sat, 15 Jul 2000 08:39:32 +0200 (CEST) From: Luigi Rizzo <luigi@info.iet.unipi.it> To: Greg Skafte <skafte@worldgate.ca> Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: ipfw accounting problem? .... Message-ID: <200007150639.IAA24985@info.iet.unipi.it> In-Reply-To: <396FB45F.47307416@worldgate.ca> from Greg Skafte at "Jul 14, 2000 06:46:23 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> > the way it is implemented is to account packets into the > > dynamic rules and probably also in the "parent" rule (the one > > with "keep-state". > > on a 4.X machine I'm only see the accounting info in the > dynamic rules, not the Parent "keep-state". I'm just wondering > if matches to the "check-state" should have accounting info? the fact is that you can have multiple places where dynamic rules are checked so the info you want can still be split over several different places. Furthermore one check-state match refers to the whole set of dynamic rules so again the info possibly logged in the check-state rule is not that significant anyways. > Some people may have issues with packet accounting being done > in the dynamic rules since some of the rules can expire in as > little as 5 seconds ( yes the timeout can be adjusted by a > sysctl but ..) Well you have to consider that ipfw in general (not only dynamic rules) was not written for accounting purposes. As an example there is no way to read&reset a counter atomically, you must always read the whole ruleset at once, and this requires the whole structure to be copied at splnet(), etc. etc. -- surely this was not a problem when rulesets were manually constructed and possibly small. Things have changed now with dynamic rules and dynamic dummynet pipes where you can have tens of thousands of entries in the ipfw ruleset. cheers luigi -----------------------------------+------------------------------------- Luigi RIZZO, luigi@iet.unipi.it . Dip. di Ing. dell'Informazione http://www.iet.unipi.it/~luigi/ . Universita` di Pisa TEL/FAX: +39-050-568.533/522 . via Diotisalvi 2, 56126 PISA (Italy) Mobile +39-347-0373137 -----------------------------------+------------------------------------- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200007150639.IAA24985>