Re: [sami] A new draft on state migration use cases is submitted.

[Melinda Shore <[e-mail]>]

On 10/10/11 10:06 PM, 卓志强(研七 福州) wrote:
> The "filtering rules" is like ACLs. As the numbers increase, the performance of different software have declined.

I read that paper.  If you go to section 4.3 you'll see that
performance varies with the underlying data structures, and
while ipfilter uses a really witless linear search the others
mentioned do not, and don't show the same performance impacts
from large numbers of installed filter rules:

"The lines for iptables on both figures show clearly the non-scaling 
behaviour of iptables. However both nf- hipac and ipset performed almost 
indifferently with regard of the number of rules. ipset was a tiny bit 
better than nf-hipac, but ipset is more lighter and simpler than 
nf-hipac. The last figure shows the required time to add the given 
number of rules to the kernel. Again, iptables suffers from its linear 
algorithms (which produces exponential behaviour in rule-addition due to 
the cumulating effect) while nf-hipac and ipset are immune from such 
problems."

Melinda