Page 1 of 1

mark connection or mark packet with Layer 7

Posted: Mon Dec 03, 2007 10:36 pm
by rafa_lore
Hello everybody
I want to know you experience with L7. The question is how to works in mangle:
1 - Someone say that first we have to mark the connections and finally the packet
2 - Another say that we only have to mark the packet to work with L7

Which is the best way to works? Normis what do you say, please?
Thank
Rafael Lore

Re: mark connection or mark packet with Layer 7

Posted: Tue Dec 04, 2007 9:42 am
by sergejs
Rafael,

both ways should work fine, however the most effective way (when you are aware of router resources) could be,
1) connection-mark with L7 matcher;
2) packet-mark without L7.

So, L7 will be checked for the new connections, but L7 will not be used to check all the packets.

Connection consists of packets.

Re: mark connection or mark packet with Layer 7

Posted: Tue Dec 04, 2007 2:23 pm
by rafa_lore
Thank you very much Sergejs
Wonderfull, I will Mark the connection with L7 and somethings with L3, and the mark the packet that have that mark connection
Thank
Rafael Lore

Re: mark connection or mark packet with Layer 7

Posted: Tue Dec 04, 2007 4:17 pm
by mrz
You should mark with L3 everything you can and pass through to L7 rules the rest, because L7 is using system resources a lot, depending on regexp complexity and connection count.

Re: mark connection or mark packet with Layer 7

Posted: Mon Dec 24, 2007 10:36 pm
by rafa_lore
thank