abusing watcher extensions for statistics and new rules

Hi,

I'm currently trying to make the kernel collect per-MAC statistics for
the traffic that goes through my bridge.
Why do that in the kernel and not with some userspace utility? Simple.
Doing it in userspace means countless context switches and sharing or
cloning the skbs which should be accounted.
So right now I'm implementing a watcher extension which uses a hash
table to store some statistics about traffic from all MAC addresses.
These statistics, however, should be usable from a match extension and
I can't figure out whether the ebtables architecture supports something
exotic like this or whether I should simply output some message to the
kernel log, watch the log from userspace and insert/delete another rule
from userspace once the log message appears.

Example:
If the MAC 00:00:de:ad:be:ef is the source of more than 5 DHCP Requests
per hour, it means the machine is either defective or has been rebooted
too often. Now block traffic from this machine automatically on the
bridge (it might have been tampered with) and notify the local admin
with a log message.


Regards,
Carl-Daniel
-- 
http://www.hailfinger.org/


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click