Linux kernel 5.7 will accelerate complex list matching in NetFilter
The developers of the Netfilter packet filtering and modification subsystem have published a set of patches that significantly speed up the processing of large match lists (nftables set) requiring the verification of combinations of subnets, network ports, protocol, and MAC addresses. The patches have already been accepted into the nf-next branch, which will be proposed for inclusion in the Linux 5.7 kernel. The most noticeable speedup has been achieved by utilizing AVX2 instructions […]
