> One strategy that I have considered is to be able to ask only for flows > that have a non-zero packet count. That would help with the common case > where, when there is a large number of flows, they are caused by a port > scan or some other activity with 1-packet flows. It wouldn't help at > all in your case.
You could also have the kernel pass down to userspace what logically amounts to a list of the flows which have had their statistics change in the past 10 seconds. A bloom filter would be a sensible approach. Again, probably won't help at all in Simon's case, and may or may-not be a useful optimization above simply not pushing down statistics for flows which have a zero packet count. Ethan _______________________________________________ dev mailing list [email protected] http://openvswitch.org/mailman/listinfo/dev
