scripts for adding rulesets for performance testing?

scripts for adding rulesets for performance testing?

[Kristen Carlson]

Hi there.  I'm doing some performance testing of iptables with increasing
rulesets and am wondering if anybody already has some scripts for adding
rules (many many rules) that they would like to share?  I noticed in the
archives that the nf-hipac folks had posted a link to a script they had used
for their performance testing which seemed to do exactly what I wanted, 
but the link is busted. 
Thanks,
Kristen

-- 
WWXD (What Would Xena Do?) 

Re: scripts for adding rulesets for performance testing?

[Willy Tarreau]

On Thu, Oct 09, 2003 at 02:14:52PM -0700, Kristen Carlson wrote:
> Hi there.  I'm doing some performance testing of iptables with increasing
> rulesets and am wondering if anybody already has some scripts for adding
> rules (many many rules) that they would like to share?  I noticed in the
> archives that the nf-hipac folks had posted a link to a script they had used
> for their performance testing which seemed to do exactly what I wanted, 
> but the link is busted. 

If your problem is "how to load a very high number of rules in a limited time",
then I strongly suggest that you use iptables-restore, which will load them
instantly at once. I have a ppro200 somewhere which takes less than a second
to load 4000 nat rules with it, while loading iptables for each of them took
ages (>15mn).

If your problem is "how to generate a lot of non-matching rules", then a simple
for() loop in shell, possibly including randoms will do the trick.

Hoping this helps
Willy

Re: scripts for adding rulesets for performance testing?

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1006 bytes --]

On Thu, Oct 09, 2003 at 02:14:52PM -0700, Kristen Carlson wrote:
> Hi there.  I'm doing some performance testing of iptables with increasing
> rulesets and am wondering if anybody already has some scripts for adding
> rules (many many rules) that they would like to share?  I noticed in the
> archives that the nf-hipac folks had posted a link to a script they had used
> for their performance testing which seemed to do exactly what I wanted, 
> but the link is busted. 

please contact them at the email address given on their homepage.  I am
sure they are very willing to fix that broken link.

> Thanks,
> Kristen


-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: scripts for adding rulesets for performance testing?

[Roberto Nibali]

Hi,

> Hi there.  I'm doing some performance testing of iptables with increasing
> rulesets and am wondering if anybody already has some scripts for adding
> rules (many many rules) that they would like to share?  I noticed in the
> archives that the nf-hipac folks had posted a link to a script they had used
> for their performance testing which seemed to do exactly what I wanted, 
> but the link is busted. 

Ok, it's up again, DNS hasn't been propagated yet. The link to the 
script, in case you still need it, is:

http://69.55.226.176/~ratz/genrules.sh

I hope to continue my test conducts with the recent development all in 
netfilter, nf-hipac, tc action and OpenBSD pf.

Best regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq'|dc