3 ms·
There are a couple of important points to consider when using Flowtables. Depending on the traffic characteristics, Flowtables may also drop the network perform
by furkansahin 3y ago
There are a couple of important points to consider when using Flowtables. Depending on the traffic characteristics, Flowtables may also drop the network performance. It also depends on the amount of rules and their configuration. For example, if we had much much more rules in nftables file for so many different operations (think of it like adding a new rule per IP address), Flowtables would hurt the performance in Ubicloud. They go hand in hand with how the overall network is configured. In our case at Ubicloud, it helps us, but we have a fairly simple Nftables definition as you can see a big part of it here https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/update_firewall_rules.rb https://github.com/ubicloud/ubicloud/blob/main/prog/vnet/upd...
- deleted 3y ago[deleted]
- chatmasta 3y agoI wonder if there are any security implications to consider, particularly in a multi-tenant environment, when caching routing information for the "same" connection.
- furkansahin 3y agoIn this case, no. The reason is, we setup separate network namespaces per VM and the flowtables are also created separately per namespace.
- BikiniPrince 3y agoSorta, you are using hardware offload at a level above the vm. There are a lot of situations in which traffic can interact poorly with that nic. You won’t really be able to identify what traffic resulted in the nic responding because of a bug. I’m assuming you are not using sr-iov vf devices if you are managing offload at the parent. Probably for the best if it is that card.