Re: Firewall performance

[Mike Shaver <shaver () mozilla org>]

Darren Reed wrote:
> In some email I received from David C Niemi, sie wrote:
> > and there is a special case to do
> > direct NIC-to-NIC transfers with certain hardware to cut out one of those
> > DMAs (if I understand NET_FASTROUTE option correctly).
>
> So how do you firewall packets which go from one NIC to the other, directly ?

If you turn on firewalling, you don't get fastroute:

CONFIG_NET_FASTROUTE
  Saying Y here enables direct NIC-to-NIC (NIC = Network Interface
  Card) data transfers, which is fast.

    *** This option is NOT COMPATIBLE with several important ***
    *** networking options: especially CONFIG*FIREWALL.      ***

Mike

-- 
1673974.39 1558509.83