Re: Question about among-dst

--On Tuesday, July 25, 2006 11:03:49 -0300 Bartman 
<bartmanxxi-/[email protected]> wrote:

> How long could be a line using ebtables among-dst option?

You're limited only by the the fact that ebtables takes the mac address 
list on the command line, and there is a maximum command line length. 
Experimentation showed that we could put around 7K mac addresses in a 
single rule, but in our production system we're limiting it to 5K addresses 
per rule.  Small numbers of multiple rules seems to be a neglible 
performance hit.  We're running around 23K addresses in our system right 
now, so thats 5 among rules.  (We're using among-src, but that should be 
functionally equivelant.)

This is in the wireless captive portal system at Carnegie Mellon 
University, providing mac address "authentication" for the campus wide 
wireless network.  See this page for more info: 
http://acs-wiki.andrew.cmu.edu/twiki/bin/view/Netreg/AuthBridge

> Why it doesn't work with targets other than ACCEPT or DROP?

That I don't know the answer to...

> Is it safe to put a lot of firewall lines into the kernel with
> atomic-save?

In fact, thats the point.  If you build the ruleset in the kernel then you 
can't update it without having moments when the ruleset is not complete. 
We're pushing the rules mentioned above into the kernel via the atomic 
operations.

-David Nolan
 Network Software Designer
 Computing Services
 Carnegie Mellon University



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys -- and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV