Tuesday, October 21, 2008

Major improvement in the speed of shadowing detection in v3.0.2

While debugging a problem for one of the users, I started looking into ways to improve speed of shadowing detection which was always very slow. The policy of the firewall object of this particular user has about 100 rules but each rule uses large group of addresses and large number of services, which leads to a huge number of possible combinations compiler needs to check in order to find if rules shadow each other. On my machine this file compiled in 17 minutes, which was too long. The code that does shadowing detection is old, was written mostly to get the algorithm right and was never optimized. Fortunately it turns out there was great potential for optimization.

The new build of v3.0.2 (build 628) includes optimized version which works about 5 times faster! Please give it a try and let me know how it works for you.

I would also appreciate if you could post your statistics here in comments or to the mailing list fwbuilder-discussion, such as total number of rules and compile times before and after the change.


Price H said...

Our iptables ruleset has almost 200 rules, with hundreds of objects and many addresses in large groups.

We were never able to use the shadowing detection before - it was simply too long. I ran our ruleset through this build and it completed in reasonable time, and I was able to clean up some shadowing.

It's definitely FASTER.

Zheng junxai5 said...

oakley vault
polo ralph lauren
michael kors outlet clearance
louboutin shoes
true religion jeans cheap
kate spade handbags
ralph lauren outlet
toms wedges
polo ralph lauren
jordan femme pas cher
cheap jordans
true religion outlet online
ugg boots
retro jordans 13
coach factory outlet online
rolex watches outlet
asics running shoes
coach outlet store online
louis vuitton outlet
michael kors outlet
toms wedges
michael kors bags
christian louboutin sneakers
mbt shoes
moncler coat
true religion uk
adidas yeezy 350
christian louboutin sale
canada goose sale
michael kors outlet online
louis vuitton handbags
cheap rolex watches
ralph lauren
michael kors outlet
gucci outlet
air jordan 11
michael kors outlet
nike tn pas cher
true religion jeans

chenmeinv0 said...

red bottom shoes
ugg australia
louis vuitton outlet
canada goose coats
canada goose jackets
polo ralph lauren
louis vuitton purses
louis vuitton purses
mulberry uk
canada goose sale
ugg uk
louis vuitton handbags
canada goose jackets
nike shoes
vikings jerseys
nike tn pas cher
uggs outlet
canada goose femme
louis vuitton bags
designer handbags outlet
michael kors outlet
fitflop sale
ugg sale
fitflop clearance
ugg outlet
tommy hilfiger clothing
tods outlet
cheap canada goose
replica rolex watches
michael kors bags
montblanc pens
cheap jordan shoes
nfl jerseys
toms shoes outlet
uggs sale
longchamp bags
cheap jordan shoes
christian louboutin pas cher
christian louboutin sale
longchamp pas cher

chenlina said...

kobe shoes
toms shoes
ugg outlet
clarks shoes
clarks outlet
ralph lauren
wizards jerseys
nike air max pas cher
nike shoes
cheap jordan shoes

raybanoutlet001 said...

rolex replica watches
cowboys jerseys
christian louboutin sale
broncos jerseys
nike air huarache
ralph lauren outlet
fitflops sale
ray ban sunglasses
ugg boots
nike outlet

ikut numpan gan said...

Jual Obat Aborsi, Klinik Aborsi, Jual Obat Cytotec, Obat Aborsi, Obat Penggugur Kandungan
Jual Obat Aborsi Alsi, Obat Penggugur Kandungan Aman, Jual Obat Aborsi Tuntas, Jual Obat Aborsi Ampuh
Jual Obat Aborsi Cytotec, Obat Aborsi Manjur, Jual Obat Aborsi Asli Ampuh, Obat Penggugur Kandungan Janin

Anna Halima said...

The article is very useful. Thanks for sharing. Also read our article about health and treatment information, I'm sure useful :)

Walatra Brain Nutrition
Walatra Zedoril 7
Perawatan Penderita Stroke di Rumah
Pengobatan Alternatif Stroke dengan Herbal

Mai Nguyễn said...

I would like more information about this, because it is very nice., Thanks for sharing.
atari breakout