svn commit: r320944 - head/etc/rc.d

[Emmanuel Vadot]

 Hi Gleb,

On Tue, 15 Aug 2017 15:49:29 -0700
Gleb Smirnoff <glebius at FreeBSD.org> wrote:

>   Emmanuel,
> 
> On Thu, Jul 13, 2017 at 01:40:18PM +0000, Emmanuel Vadot wrote:
> E> Author: manu
> E> Date: Thu Jul 13 13:40:18 2017
> E> New Revision: 320944
> E> URL: https://svnweb.freebsd.org/changeset/base/320944
> E> 
> E> Log:
> E>   Add an rc.d script to setup a netflow export via ng_netflow
> E>   The default is to export netflow data on localhost on the netflow port.
> E>   ngtee is used to have the lowest overhead possible.
> E>   The ipfw ng hook is the netflow port (it can only be numeric)
> E>   Default is netflow version 5.
> E>   
> E>   Sponsored-By:   Gandi.net
> E>   Reviewed by:	bapt (earlier version), olivier (earlier version)
> 
> It could be that using "netgraph" action instead of "ngtee" and then
> returning packet back from netgraph to ipfw would show lower overhead.
> However, this setup is definitely going to be less robust and more prone
> to bugs in case of complex ipfw configurations.
> 
> -- 
> Totus tuus, Glebius.

 I should have been more clear, I didn't mean that it would have less
overhead in memory but in process time.
 Reading the source code I saw that ngtee simply m_dup the packet
and then ipfw directly continue with the original one, so it seems to
me that this would be the the fastest way to process packets.

 Could you expand on "less robust and more prone to bugs" for the
"netgraph" case ?

 Cheers,

-- 
Emmanuel Vadot <manu at bidouilliste.com> <manu at freebsd.org>