Conntrack evolved recently and is thought to be fast. Florian Westphal once said that an iptable rule doing -j NOTRACK is slower than hitting conntrack. The ra

Conntrack evolved recently and is thought to be fast. Florian Westphal once said that an iptable rule doing -j NOTRACK is slower than hitting conntrack. The rationale is that iptables need to do indirect jumps, which with spetre mitigations means retpoline which means slow. So... conntrack avoids the indirect jumps and is faster than a couple of indirect jumps that would be taken on the iptables exception path. But I haven't done the benchmarks so I didn't want to put that in the post. Anyhow, barring the SYN flood aspect, I think conntrack is fast enough for everybody. The only exceptions might be... dunno... HFT.