Re: postscreen-policy (was: Feature request for postscreen: "defer")

2018-01-19 Thread Wietse Venema
Patrick Ben Koetter: > * Wietse Venema : > > Patrick Ben Koetter: > > > * Wietse Venema : > > > > Wietse Venema: > > > > > Unlike DNS lookups, the access map lookup is a blocking operation, > > > > > and if your tcp map takes 80ms to complete (a typical trans-atlantic > > > > > query), then you can

Re: postscreen-policy (was: Feature request for postscreen: "defer")

2018-01-19 Thread Patrick Ben Koetter
* Wietse Venema : > Patrick Ben Koetter: > > * Wietse Venema : > > > Wietse Venema: > > > > Unlike DNS lookups, the access map lookup is a blocking operation, > > > > and if your tcp map takes 80ms to complete (a typical trans-atlantic > > > > query), then you can handle only 12 connections per sec

Re: postscreen-policy (was: Feature request for postscreen: "defer")

2016-09-13 Thread Wietse Venema
Patrick Ben Koetter: > * Wietse Venema : > > Wietse Venema: > > > Unlike DNS lookups, the access map lookup is a blocking operation, > > > and if your tcp map takes 80ms to complete (a typical trans-atlantic > > > query), then you can handle only 12 connections per second, and > > > make postsceen

Re: postscreen-policy (was: Feature request for postscreen: "defer")

2016-09-13 Thread Patrick Ben Koetter
* Wietse Venema : > Wietse Venema: > > Unlike DNS lookups, the access map lookup is a blocking operation, > > and if your tcp map takes 80ms to complete (a typical trans-atlantic > > query), then you can handle only 12 connections per second, and > > make postsceen the largest performance bottlenec

postscreen-policy (was: Feature request for postscreen: "defer")

2016-09-13 Thread Wietse Venema
Wietse Venema: > Unlike DNS lookups, the access map lookup is a blocking operation, > and if your tcp map takes 80ms to complete (a typical trans-atlantic > query), then you can handle only 12 connections per second, and > make postsceen the largest performance bottleneck on the system. After star