On Sun, 16 Mar 2008 18:20:12 +0100 (CET) Wojciech Puchar <[EMAIL PROTECTED]> wrote: > >> > >> what's wrong in userland natd? > > > > Performance. With userland natd, every packet that passes through natd > > must pass from kernel to userland (causing one context switch) and back > > again (causing another context switch). This will be slower and use more > > CPU than doing it all inside the kernel, without any context switches. > > true, anyway for my two 2Mbps symmetric connection (all for nat), and > three 4/0.5Mbit connections (part for nat, mostly for squid) all natd > processes takes at most 3 percent of single core (core2duo).
Sure. And with my little 512/128k ADSL link, soon 1500/256, I doubt you could even measure the difference. I haven't seen any comparative data on high-performance boxes but as Erik points out, it may be significant. Just to make it clear, my point was that one reason for deprecating ipfw is out the door, and that its development is ongoing. I see rc.firewall has had a recent facelift too, including a stateful 'workstation' type. (Sorry that our ancient mail setup blocked your mail; hopefully fixed.) cheers, Ian _______________________________________________ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"
