Re: Dynamically classifying flows?

[Patrick McHardy <kaber@xxxxxxxxx>]

Asim Shankar wrote:
> > It is a likely scenario but usually not a problem because you can classify this
> > kind of bulk packets by their size. u32 can be used use for such things or the
> > newly added meta ematch.
>
> Filtering by size may not always work. An interactive flow may also
> generate big (MTU) size packets, but it is interactive because the
> _rate_ at which packets are produced is smaller. Though, if you think
> that such cases are purely theoretical and don't create problems in
> practice, do let me know.

The connbytes and the connrate match from netfilter patch-o-matic can
be used to dynamically reclassify demanding connections. Keep in mind
that reclassification can cause reordering, so you should make sure
it can't happen frequently for single connections.

Regards
Patrick