1. Is there a way to solve performance issues ?
Userspace decision
Is there a way to solve performance issues ?
Eric Leblond
CTO 1

2. libnetfilter_queue A good usable library Stable Easy to use
Raw performance is not excellent
Fine tuning is possible :
Buffer size
Queue multiplication (solve production issue)

3. Performance metric It seems 30 kpps is a limit : Independant study
Independant of materials
Comparison with PF_RING :
Best performance : 1.13 Mpps
Average : 700 kpps

4. Conception issue libnetfilter_queue depends on Nfnetlink
Message passing
Memory copy
Kernel to message
Userspace
Some kernel side tricks
Linked list to store the queued packet
Other ?

5. Way to higher performance
Things to do
Avoid message passing system
Reduce copy
Implement a batching comparable to NFLOG
Adopt similar architecture as PF_RING
Can it be done ?
Could it be integrated into Netfilter ?
Other ways ?