archive mirror
 help / color / mirror / Atom feed
* [ANNOUNCE] NF-HIPAC: High Performance Packet Classification for Netfilter
@ 2002-09-25 22:41 nf
  2002-09-25 22:52 ` David S. Miller
  0 siblings, 1 reply; 15+ messages in thread
From: nf @ 2002-09-25 22:41 UTC (permalink / raw)
  To: linux-kernel


nf-hipac aims to become a drop-in replacement for the iptables packet 
filtering module. It implements a novel framework for packet classification 
which uses an advanced algorithm to reduce the number of memory lookups per 
packet. The module is ideal for environments where large rulesets and/or
high bandwidth networks are involved.

The algorithm code is designed in a way that it can be verified in userspace, 
so the algorithm code itself can be considered correct. We are not able to 
really verify the remaining files nfhp_mod.[ch] and the userspace tool 
(nf-hipac.[ch]), but they are tested in depth and shouldn't contain any 
critical bugs.

We have the results of some basic performance tests available on our web page. 
The test compares the performance of the iptables filter table to the 
performance of nf-hipac. Results are pretty impressive :-)

You can find the performance test results on our web page
The releases can be downloaded from

    - optimized for high performance packet classification
      with moderate memory usage
    - completely dynamic:
        data structure isn't rebuild from scratch when inserting or
        deleting rules, so fast updates are possible
    - userspace tool syntax is very similar to the iptables syntax
    - kernel does not need to be patched
    - compatible to iptables: you can use iptables and nf-hipac at
      the same time:
        for example you could use the connection tracking module from
        iptables and match the states with nf-hipac
    - match support for:
        + source/destination ip
        + in/out interface
        + protocol (udp, tcp, icmp)
        + source/destination ports (udp, tcp)
        + icmp type
        + tcp flags
        + ttl
        + state match (conntrack module must be loaded)
   - /proc/net/nf-hipac:
        + algorithm statistics available via
            # cat /proc/net/nf-hipac
        + allows to dynamically limit the maximum memory usage
            # echo   >  /proc/net/nf-hipac


|   Michael Bellion     |     Thomas Heinz     |
| <>  |  <> |

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2002-09-28  1:32 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-09-25 22:41 [ANNOUNCE] NF-HIPAC: High Performance Packet Classification for Netfilter nf
2002-09-25 22:52 ` David S. Miller
2002-09-26  0:10   ` Rik van Riel
2002-09-26  0:25     ` David S. Miller
2002-09-26  0:38   ` nf
2002-09-26  0:37     ` David S. Miller
2002-09-26  1:44       ` nf
2002-09-26  3:30         ` David S. Miller
2002-09-26  5:19   ` Rusty Russell
2002-09-26  5:40     ` David S. Miller
2002-09-26 15:27       ` James Morris
2002-09-26 20:52         ` David S. Miller
2002-09-27  3:00           ` Michael Richardson
2002-09-27 14:12           ` jamal
2002-09-28  1:30             ` David S. Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).