Performance effect on using multiple (500) MARK target rules

Performance effect on using multiple (500) MARK target rules

[Nicholas Basker]

Hello:

I am planning to use the following MARK rule.

iptables -t mangle -A POSTROUTING -d <ipaddr>/<netmask> -j MARK --set-mark
<mark-id>

In my application, there may be around 500 mark rules like above. They can
change dynamically which means that some mark rule may be removed and new
ones can be added. So at a given time there may be around 500 such rules in
the system.

I have the following questions on the MARK rule. It would be helpful if you
could point me to the code to understand better.

01. With around 500 rules, there shall be 500 ipaddr/netmask that need to be
matched for every packet. Will this be significant performance degradation?.

02. How does the matching for destination ipaddr/netmask happen? Is there an
efficient hash scheme used. It would be helpful if you can point me to the
code where this happens.

03. Is the skbuff->nfmark field used to store the mark value. This is
available with the skbuff even at the L2 driver layer. For example
ethernet-driver or anyother layer2 driver. Is my assumption correct.

I very much appreciate your response. Thanks for your time,
Nicholas.