Since IPTABLES is a software based firewall, I am wondering if it is possible to log the exact load it is causing, cpu cycles, etc.
On a small system I am sure it is trivial. But how about with thousands of rules?
Looking in TOP and PS, this seems to elude me, so it must be a kernel level component?
Can it be isolated and monitored/logged?
eta: for clarity, on modern linux, iptables is not a visible process or daemon so it cannot be seen for example with ps aux and I am at a loss for how to isolate it from the kernel otherwise
1 Answer
The actual processing of the iptables rules is done in softirq context so changes in the si% value in top (or %soft in mpstat) should give a hint about how much load it causes. If you want more details you could use the ftrace function tracer (see for more info) to log the calls to the respective kernel functions and measure the latency. However, this requires support in the kernel, i.e. specific kernel config options.
