Hi Oz, On Wed, Jan 20, 2021 at 06:09:48PM +0200, Oz Shlomo wrote: > On 1/14/2021 11:50 PM, Marcelo Ricardo Leitner wrote: > > > > Thoughts? > > > > I wonder if we should develop a generic mechanism to optimize CT software > for a use case that is faulty by design. > This has limited value for software as it would only reduce the conntrack > table size (packet classification is still required). > However, this feature may have a big impact on hardware offload. > Normally hardware offload relies on software to handle new connections. > Causing all new connections to be processed by software. > With this patch the hardware may autonomously set the +new connection state > for the relevant connections.
Could you fix this issue with unidirectional flows by checking for IPS_CONFIRMED status bit? The idea is to hardware offload the entry after the first packet goes through software successfully. Then, there is no need to wait for the established state that requires to see traffic in both directions.
