| |||||||||||||
LPC: Making the net go faster (Briefly: user-space network queues)LPC: Making the net go faster (Briefly: user-space network queues)Posted Sep 16, 2011 9:09 UTC (Fri) by michaeljt (subscriber, #39183)In reply to: LPC: Making the net go faster (Briefly: user-space network queues) by skitching Parent article: LPC: Making the net go faster
> There are two types of firewalling: plain address/port checks that are applied when a connection is opened, and "stateful firewalling" where the actual data stream is inspected.
I agree, that sort of firewall cannot be implemented by just allowing or disallowing connections when they are first made. If you don't want an additional data copy it might work if the card is writing to a shared memory buffer which is only made available to the application once the firewall has given the green light. That would slow things down quite a bit, but I think if you want to inspect data that closely you have to live with that anyway (or use an external firewall). Having the receiver process itself doing the inspection as suggested by appie above [1] is probably not really an option here, as this sort of firewall is most likely there to stop the user doing things they may want to do but you (for some value of you) don't.
(Log in to post comments)
|
|||||||||||||