€•¶z      Œsphinx.addnodes”Œdocument”“”)”}”(Œ	rawsource”Œ ”Œchildren”]”(Œtranslations”ŒLanguagesNode”“”)”}”(hhh]”(h Œpending_xref”“”)”}”(hhh]”Œdocutils.nodes”ŒText”“”ŒChinese (Simplified)”…””}”Œparent”hsbaŒ
attributes”}”(Œids”]”Œclasses”]”Œnames”]”Œdupnames”]”Œbackrefs”]”Œ	refdomain”Œstd”Œreftype”Œdoc”Œ	reftarget”Œ+/translations/zh_CN/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuŒtagname”hhhubh)”}”(hhh]”hŒChinese (Traditional)”…””}”hh2sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ+/translations/zh_TW/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒItalian”…””}”hhFsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ+/translations/it_IT/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒJapanese”…””}”hhZsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ+/translations/ja_JP/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒKorean”…””}”hhnsbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ+/translations/ko_KR/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubh)”}”(hhh]”hŒSpanish”…””}”hh‚sbah}”(h]”h ]”h"]”h$]”h&]”Œ	refdomain”h)Œreftype”h+Œ	reftarget”Œ+/translations/sp_SP/networking/nf_flowtable”Œmodname”NŒ	classname”NŒrefexplicit”ˆuh1hhhubeh}”(h]”h ]”h"]”h$]”h&]”Œcurrent_language”ŒEnglish”uh1h
hhŒ	_document”hŒsource”NŒline”NubhŒcomment”“”)”}”(hŒ SPDX-License-Identifier: GPL-2.0”h]”hŒ SPDX-License-Identifier: GPL-2.0”…””}”hh£sbah}”(h]”h ]”h"]”h$]”h&]”Œ	xml:space”Œpreserve”uh1h¡hhhžhhŸŒE/var/lib/git/docbuild/linux/Documentation/networking/nf_flowtable.rst”h KubhŒsection”“”)”}”(hhh]”(hŒtitle”“”)”}”(hŒ$Netfilter's flowtable infrastructure”h]”hŒ&Netfilterâ€™s flowtable infrastructure”…””}”(hh»hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hh¶hžhhŸh³h KubhŒ	paragraph”“”)”}”(hX!  This documentation describes the Netfilter flowtable infrastructure which allows
you to define a fastpath through the flowtable datapath. This infrastructure
also provides hardware offload support. The flowtable supports for the layer 3
IPv4 and IPv6 and the layer 4 TCP and UDP protocols.”h]”hX!  This documentation describes the Netfilter flowtable infrastructure which allows
you to define a fastpath through the flowtable datapath. This infrastructure
also provides hardware offload support. The flowtable supports for the layer 3
IPv4 and IPv6 and the layer 4 TCP and UDP protocols.”…””}”(hhËhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khh¶hžhubhµ)”}”(hhh]”(hº)”}”(hŒOverview”h]”hŒOverview”…””}”(hhÜhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hhÙhžhhŸh³h KubhÊ)”}”(hX.  Once the first packet of the flow successfully goes through the IP forwarding
path, from the second packet on, you might decide to offload the flow to the
flowtable through your ruleset. The flowtable infrastructure provides a rule
action that allows you to specify when to add a flow to the flowtable.”h]”hX.  Once the first packet of the flow successfully goes through the IP forwarding
path, from the second packet on, you might decide to offload the flow to the
flowtable through your ruleset. The flowtable infrastructure provides a rule
action that allows you to specify when to add a flow to the flowtable.”…””}”(hhêhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KhhÙhžhubhÊ)”}”(hX©  A packet that finds a matching entry in the flowtable (ie. flowtable hit) is
transmitted to the output netdevice via neigh_xmit(), hence, packets bypass the
classic IP forwarding path (the visible effect is that you do not see these
packets from any of the Netfilter hooks coming after ingress). In case that
there is no matching entry in the flowtable (ie. flowtable miss), the packet
follows the classic IP forwarding path.”h]”hX©  A packet that finds a matching entry in the flowtable (ie. flowtable hit) is
transmitted to the output netdevice via neigh_xmit(), hence, packets bypass the
classic IP forwarding path (the visible effect is that you do not see these
packets from any of the Netfilter hooks coming after ingress). In case that
there is no matching entry in the flowtable (ie. flowtable miss), the packet
follows the classic IP forwarding path.”…””}”(hhøhžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KhhÙhžhubhÊ)”}”(hX*  The flowtable uses a resizable hashtable. Lookups are based on the following
n-tuple selectors: layer 2 protocol encapsulation (VLAN and PPPoE), layer 3
source and destination, layer 4 source and destination ports and the input
interface (useful in case there are several conntrack zones in place).”h]”hX*  The flowtable uses a resizable hashtable. Lookups are based on the following
n-tuple selectors: layer 2 protocol encapsulation (VLAN and PPPoE), layer 3
source and destination, layer 4 source and destination ports and the input
interface (useful in case there are several conntrack zones in place).”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KhhÙhžhubhÊ)”}”(hX  The 'flow add' action allows you to populate the flowtable, the user selectively
specifies what flows are placed into the flowtable. Hence, packets follow the
classic IP forwarding path unless the user explicitly instruct flows to use this
new alternative forwarding path via policy.”h]”hX  The â€˜flow addâ€™ action allows you to populate the flowtable, the user selectively
specifies what flows are placed into the flowtable. Hence, packets follow the
classic IP forwarding path unless the user explicitly instruct flows to use this
new alternative forwarding path via policy.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K hhÙhžhubhÊ)”}”(hŒŸThe flowtable datapath is represented in Fig.1, which describes the classic IP
forwarding path including the Netfilter hooks and the flowtable fastpath bypass.”h]”hŒŸThe flowtable datapath is represented in Fig.1, which describes the classic IP
forwarding path including the Netfilter hooks and the flowtable fastpath bypass.”…””}”(hj"  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K%hhÙhžhubhŒliteral_block”“”)”}”(hXp                                         userspace process
                                        ^              |
                                        |              |
                                   _____|____     ____\/___
                                  /          \   /         \
                                  |   input   |  |  output  |
                                  \__________/   \_________/
                                       ^               |
                                       |               |
    _________      __________      ---------     _____\/_____
   /         \    /          \     |Routing |   /            \
-->  ingress  ---> prerouting ---> |decision|   | postrouting |--> neigh_xmit
   \_________/    \__________/     ----------   \____________/          ^
     |      ^                          |               ^                |
 flowtable  |                     ____\/___            |                |
     |      |                    /         \           |                |
  __\/___   |                    | forward |------------                |
  |-----|   |                    \_________/                            |
  |-----|   |                 'flow offload' rule                       |
  |-----|   |                   adds entry to                           |
  |_____|   |                     flowtable                             |
     |      |                                                           |
    / \     |                                                           |
   /hit\_no_|                                                           |
   \ ? /                                                                |
    \ /                                                                 |
     |__yes_________________fastpath bypass ____________________________|

             Fig.1 Netfilter hooks and flowtable interactions”h]”hXp                                         userspace process
                                        ^              |
                                        |              |
                                   _____|____     ____\/___
                                  /          \   /         \
                                  |   input   |  |  output  |
                                  \__________/   \_________/
                                       ^               |
                                       |               |
    _________      __________      ---------     _____\/_____
   /         \    /          \     |Routing |   /            \
-->  ingress  ---> prerouting ---> |decision|   | postrouting |--> neigh_xmit
   \_________/    \__________/     ----------   \____________/          ^
     |      ^                          |               ^                |
 flowtable  |                     ____\/___            |                |
     |      |                    /         \           |                |
  __\/___   |                    | forward |------------                |
  |-----|   |                    \_________/                            |
  |-----|   |                 'flow offload' rule                       |
  |-----|   |                   adds entry to                           |
  |_____|   |                     flowtable                             |
     |      |                                                           |
    / \     |                                                           |
   /hit\_no_|                                                           |
   \ ? /                                                                |
    \ /                                                                 |
     |__yes_________________fastpath bypass ____________________________|

             Fig.1 Netfilter hooks and flowtable interactions”…””}”hj2  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h K*hhÙhžhubhÊ)”}”(hXn  The flowtable entry also stores the NAT configuration, so all packets are
mangled according to the NAT policy that is specified from the classic IP
forwarding path. The TTL is decremented before calling neigh_xmit(). Fragmented
traffic is passed up to follow the classic IP forwarding path given that the
transport header is missing, in this case, flowtable lookups are not possible.
TCP RST and FIN packets are also passed up to the classic IP forwarding path to
release the flow gracefully. Packets that exceed the MTU are also passed up to
the classic forwarding path to report packet-too-big ICMP errors to the sender.”h]”hXn  The flowtable entry also stores the NAT configuration, so all packets are
mangled according to the NAT policy that is specified from the classic IP
forwarding path. The TTL is decremented before calling neigh_xmit(). Fragmented
traffic is passed up to follow the classic IP forwarding path given that the
transport header is missing, in this case, flowtable lookups are not possible.
TCP RST and FIN packets are also passed up to the classic IP forwarding path to
release the flow gracefully. Packets that exceed the MTU are also passed up to
the classic forwarding path to report packet-too-big ICMP errors to the sender.”…””}”(hj@  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KHhhÙhžhubeh}”(h]”Œoverview”ah ]”h"]”Œoverview”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kubhµ)”}”(hhh]”(hº)”}”(hŒExample configuration”h]”hŒExample configuration”…””}”(hjY  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjV  hžhhŸh³h KRubhÊ)”}”(hŒ~Enabling the flowtable bypass is relatively easy, you only need to create a
flowtable and add one rule to your forward chain::”h]”hŒ}Enabling the flowtable bypass is relatively easy, you only need to create a
flowtable and add one rule to your forward chain:”…””}”(hjg  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KThjV  hžhubj1  )”}”(hX)  table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
        }
        chain y {
                type filter hook forward priority 0; policy accept;
                ip protocol tcp flow add @f
                counter packets 0 bytes 0
        }
}”h]”hX)  table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
        }
        chain y {
                type filter hook forward priority 0; policy accept;
                ip protocol tcp flow add @f
                counter packets 0 bytes 0
        }
}”…””}”hju  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h KWhjV  hžhubhÊ)”}”(hXÎ  This example adds the flowtable 'f' to the ingress hook of the eth0 and eth1
netdevices. You can create as many flowtables as you want in case you need to
perform resource partitioning. The flowtable priority defines the order in which
hooks are run in the pipeline, this is convenient in case you already have a
nftables ingress chain (make sure the flowtable priority is smaller than the
nftables ingress chain hence the flowtable runs before in the pipeline).”h]”hXÒ  This example adds the flowtable â€˜fâ€™ to the ingress hook of the eth0 and eth1
netdevices. You can create as many flowtables as you want in case you need to
perform resource partitioning. The flowtable priority defines the order in which
hooks are run in the pipeline, this is convenient in case you already have a
nftables ingress chain (make sure the flowtable priority is smaller than the
nftables ingress chain hence the flowtable runs before in the pipeline).”…””}”(hjƒ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KbhjV  hžhubhÊ)”}”(hXB  The 'flow offload' action from the forward chain 'y' adds an entry to the
flowtable for the TCP syn-ack packet coming in the reply direction. Once the
flow is offloaded, you will observe that the counter rule in the example above
does not get updated for the packets that are being forwarded through the
forwarding bypass.”h]”hXJ  The â€˜flow offloadâ€™ action from the forward chain â€˜yâ€™ adds an entry to the
flowtable for the TCP syn-ack packet coming in the reply direction. Once the
flow is offloaded, you will observe that the counter rule in the example above
does not get updated for the packets that are being forwarded through the
forwarding bypass.”…””}”(hj‘  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KihjV  hžhubhÊ)”}”(hŒgYou can identify offloaded flows through the [OFFLOAD] tag when listing your
connection tracking table.”h]”hŒgYou can identify offloaded flows through the [OFFLOAD] tag when listing your
connection tracking table.”…””}”(hjŸ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KohjV  hžhubj1  )”}”(hŒ¡# conntrack -L
tcp      6 src=10.141.10.2 dst=192.168.10.2 sport=52728 dport=5201 src=192.168.10.2 dst=192.168.10.1 sport=5201 dport=52728 [OFFLOAD] mark=0 use=2”h]”hŒ¡# conntrack -L
tcp      6 src=10.141.10.2 dst=192.168.10.2 sport=52728 dport=5201 src=192.168.10.2 dst=192.168.10.1 sport=5201 dport=52728 [OFFLOAD] mark=0 use=2”…””}”hj­  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h KthjV  hžhubeh}”(h]”Œexample-configuration”ah ]”h"]”Œexample configuration”ah$]”h&]”uh1h´hh¶hžhhŸh³h KRubhµ)”}”(hhh]”(hº)”}”(hŒLayer 2 encapsulation”h]”hŒLayer 2 encapsulation”…””}”(hjÆ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjÃ  hžhhŸh³h KyubhÊ)”}”(hXb  Since Linux kernel 5.13, the flowtable infrastructure discovers the real
netdevice behind VLAN and PPPoE netdevices. The flowtable software datapath
parses the VLAN and PPPoE layer 2 headers to extract the ethertype and the
VLAN ID / PPPoE session ID which are used for the flowtable lookups. The
flowtable datapath also deals with layer 2 decapsulation.”h]”hXb  Since Linux kernel 5.13, the flowtable infrastructure discovers the real
netdevice behind VLAN and PPPoE netdevices. The flowtable software datapath
parses the VLAN and PPPoE layer 2 headers to extract the ethertype and the
VLAN ID / PPPoE session ID which are used for the flowtable lookups. The
flowtable datapath also deals with layer 2 decapsulation.”…””}”(hjÔ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K{hjÃ  hžhubhÊ)”}”(hŒ•You do not need to add the PPPoE and the VLAN devices to your flowtable,
instead the real device is sufficient for the flowtable to track your flows.”h]”hŒ•You do not need to add the PPPoE and the VLAN devices to your flowtable,
instead the real device is sufficient for the flowtable to track your flows.”…””}”(hjâ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KhjÃ  hžhubeh}”(h]”Œlayer-2-encapsulation”ah ]”h"]”Œlayer 2 encapsulation”ah$]”h&]”uh1h´hh¶hžhhŸh³h Kyubhµ)”}”(hhh]”(hº)”}”(hŒBridge and IP forwarding”h]”hŒBridge and IP forwarding”…””}”(hjû  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjø  hžhhŸh³h K…ubhÊ)”}”(hX_  Since Linux kernel 5.13, you can add bridge ports to the flowtable. The
flowtable infrastructure discovers the topology behind the bridge device. This
allows the flowtable to define a fastpath bypass between the bridge ports
(represented as eth1 and eth2 in the example figure below) and the gateway
device (represented as eth0) in your switch/router.”h]”hX_  Since Linux kernel 5.13, you can add bridge ports to the flowtable. The
flowtable infrastructure discovers the topology behind the bridge device. This
allows the flowtable to define a fastpath bypass between the bridge ports
(represented as eth1 and eth2 in the example figure below) and the gateway
device (represented as eth0) in your switch/router.”…””}”(hj	  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K‡hjø  hžhubj1  )”}”(hX6          fastpath bypass
 .-------------------------.
/                           \
|           IP forwarding   |
|          /             \ \/
|       br0               eth0 ..... eth0
.       / \                          *host B*
 -> eth1  eth2
     .           *switch/router*
     .
     .
   eth0
 *host A*”h]”hX6          fastpath bypass
 .-------------------------.
/                           \
|           IP forwarding   |
|          /             \ \/
|       br0               eth0 ..... eth0
.       / \                          *host B*
 -> eth1  eth2
     .           *switch/router*
     .
     .
   eth0
 *host A*”…””}”hj  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h Khjø  hžhubhÊ)”}”(hŒ¬The flowtable infrastructure also supports for bridge VLAN filtering actions
such as PVID and untagged. You can also stack a classic VLAN device on top of
your bridge port.”h]”hŒ¬The flowtable infrastructure also supports for bridge VLAN filtering actions
such as PVID and untagged. You can also stack a classic VLAN device on top of
your bridge port.”…””}”(hj%  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Khjø  hžhubhÊ)”}”(hŒÖIf you would like that your flowtable defines a fastpath between your bridge
ports and your IP forwarding path, you have to add your bridge ports (as
represented by the real netdevice) to your flowtable definition.”h]”hŒÖIf you would like that your flowtable defines a fastpath between your bridge
ports and your IP forwarding path, you have to add your bridge ports (as
represented by the real netdevice) to your flowtable definition.”…””}”(hj3  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K¡hjø  hžhubeh}”(h]”Œbridge-and-ip-forwarding”ah ]”h"]”Œbridge and ip forwarding”ah$]”h&]”uh1h´hh¶hžhhŸh³h K…ubhµ)”}”(hhh]”(hº)”}”(hŒCounters”h]”hŒCounters”…””}”(hjL  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjI  hžhhŸh³h K¦ubhÊ)”}”(hŒ©The flowtable can synchronize packet and byte counters with the existing
connection tracking entry by specifying the counter statement in your flowtable
definition, e.g.”h]”hŒ©The flowtable can synchronize packet and byte counters with the existing
connection tracking entry by specifying the counter statement in your flowtable
definition, e.g.”…””}”(hjZ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h K¨hjI  hžhubj1  )”}”(hŒ‹table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
                counter
        }
}”h]”hŒ‹table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
                counter
        }
}”…””}”hjh  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h K®hjI  hžhubhÊ)”}”(hŒ4Counter support is available since Linux kernel 5.7.”h]”hŒ4Counter support is available since Linux kernel 5.7.”…””}”(hjv  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KµhjI  hžhubeh}”(h]”Œcounters”ah ]”h"]”Œcounters”ah$]”h&]”uh1h´hh¶hžhhŸh³h K¦ubhµ)”}”(hhh]”(hº)”}”(hŒHardware offload”h]”hŒHardware offload”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjŒ  hžhhŸh³h K¸ubhÊ)”}”(hŒŽIf your network device provides hardware offload support, you can turn it on by
means of the 'offload' flag in your flowtable definition, e.g.”h]”hŒ’If your network device provides hardware offload support, you can turn it on by
means of the â€˜offloadâ€™ flag in your flowtable definition, e.g.”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KºhjŒ  hžhubj1  )”}”(hŒ’table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
                flags offload;
        }
}”h]”hŒ’table inet x {
        flowtable f {
                hook ingress priority 0; devices = { eth0, eth1 };
                flags offload;
        }
}”…””}”hj«  sbah}”(h]”h ]”h"]”h$]”h&]”h±h²uh1j0  hŸh³h K¿hjŒ  hžhubhÊ)”}”(hŒÎThere is a workqueue that adds the flows to the hardware. Note that a few
packets might still run over the flowtable software path until the workqueue has
a chance to offload the flow to the network device.”h]”hŒÎThere is a workqueue that adds the flows to the hardware. Note that a few
packets might still run over the flowtable software path until the workqueue has
a chance to offload the flow to the network device.”…””}”(hj¹  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÆhjŒ  hžhubhÊ)”}”(hXo  You can identify hardware offloaded flows through the [HW_OFFLOAD] tag when
listing your connection tracking table. Please, note that the [OFFLOAD] tag
refers to the software offload mode, so there is a distinction between [OFFLOAD]
which refers to the software flowtable fastpath and [HW_OFFLOAD] which refers
to the hardware offload datapath being used by the flow.”h]”hXo  You can identify hardware offloaded flows through the [HW_OFFLOAD] tag when
listing your connection tracking table. Please, note that the [OFFLOAD] tag
refers to the software offload mode, so there is a distinction between [OFFLOAD]
which refers to the software flowtable fastpath and [HW_OFFLOAD] which refers
to the hardware offload datapath being used by the flow.”…””}”(hjÇ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÊhjŒ  hžhubhÊ)”}”(hŒjThe flowtable hardware offload infrastructure also supports for the DSA
(Distributed Switch Architecture).”h]”hŒjThe flowtable hardware offload infrastructure also supports for the DSA
(Distributed Switch Architecture).”…””}”(hjÕ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÐhjŒ  hžhubeh}”(h]”Œhardware-offload”ah ]”h"]”Œhardware offload”ah$]”h&]”uh1h´hh¶hžhhŸh³h K¸ubhµ)”}”(hhh]”(hº)”}”(hŒLimitations”h]”hŒLimitations”…””}”(hjî  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hjë  hžhhŸh³h KÔubhÊ)”}”(hŒ®The flowtable behaves like a cache. The flowtable entries might get stale if
either the destination MAC address or the egress netdevice that is used for
transmission changes.”h]”hŒ®The flowtable behaves like a cache. The flowtable entries might get stale if
either the destination MAC address or the egress netdevice that is used for
transmission changes.”…””}”(hjü  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÖhjë  hžhubhÊ)”}”(hŒThis might be a problem if:”h]”hŒThis might be a problem if:”…””}”(hj
  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÚhjë  hžhubhŒbullet_list”“”)”}”(hhh]”(hŒ	list_item”“”)”}”(hŒ^You run the flowtable in software mode and you combine bridge and IP
forwarding in your setup.”h]”hÊ)”}”(hŒ^You run the flowtable in software mode and you combine bridge and IP
forwarding in your setup.”h]”hŒ^You run the flowtable in software mode and you combine bridge and IP
forwarding in your setup.”…””}”(hj#  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÜhj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj  hžhhŸh³h Nubj  )”}”(hŒHardware offload is enabled.
”h]”hÊ)”}”(hŒHardware offload is enabled.”h]”hŒHardware offload is enabled.”…””}”(hj;  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KÞhj7  ubah}”(h]”h ]”h"]”h$]”h&]”uh1j  hj  hžhhŸh³h Nubeh}”(h]”h ]”h"]”h$]”h&]”Œbullet”Œ-”uh1j  hŸh³h KÜhjë  hžhubeh}”(h]”Œlimitations”ah ]”h"]”Œlimitations”ah$]”h&]”uh1h´hh¶hžhhŸh³h KÔubhµ)”}”(hhh]”(hº)”}”(hŒMore reading”h]”hŒMore reading”…””}”(hjb  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1h¹hj_  hžhhŸh³h KáubhÊ)”}”(hX,  This documentation is based on the LWN.net articles [1]_\ [2]_. Rafal Milecki
also made a very complete and comprehensive summary called "A state of network
acceleration" that describes how things were before this infrastructure was
mainlined [3]_ and it also makes a rough summary of this work [4]_.”h]”(hŒ4This documentation is based on the LWN.net articles ”…””}”(hjp  hžhhŸNh NubhŒfootnote_reference”“”)”}”(hŒ[1]_”h]”hŒ1”…””}”(hjz  hžhhŸNh Nubah}”(h]”Œid1”ah ]”h"]”h$]”h&]”Œrefid”Œid5”Œdocname”Œnetworking/nf_flowtable”uh1jx  hjp  Œresolved”KubhŒ  ”…””}”(hjp  hžhhŸNh Nubjy  )”}”(hŒ[2]_”h]”hŒ2”…””}”(hj’  hžhhŸNh Nubah}”(h]”Œid2”ah ]”h"]”h$]”h&]”j‰  Œid6”j‹  jŒ  uh1jx  hjp  j  KubhŒ¹. Rafal Milecki
also made a very complete and comprehensive summary called â€œA state of network
accelerationâ€ that describes how things were before this infrastructure was
mainlined ”…””}”(hjp  hžhhŸNh Nubjy  )”}”(hŒ[3]_”h]”hŒ3”…””}”(hj¦  hžhhŸNh Nubah}”(h]”Œid3”ah ]”h"]”h$]”h&]”j‰  Œid7”j‹  jŒ  uh1jx  hjp  j  KubhŒ0 and it also makes a rough summary of this work ”…””}”(hjp  hžhhŸNh Nubjy  )”}”(hŒ[4]_”h]”hŒ4”…””}”(hjº  hžhhŸNh Nubah}”(h]”Œid4”ah ]”h"]”h$]”h&]”j‰  Œid8”j‹  jŒ  uh1jx  hjp  j  KubhŒ.”…””}”(hjp  hžhhŸNh Nubeh}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Kãhj_  hžhubhŒfootnote”“”)”}”(hŒ https://lwn.net/Articles/738214/”h]”(hŒlabel”“”)”}”(hŒ1”h]”hŒ1”…””}”(hjÜ  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÚ  hjÖ  ubhÊ)”}”(hjØ  h]”hŒ	reference”“”)”}”(hjØ  h]”hŒ https://lwn.net/Articles/738214/”…””}”(hjï  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”jØ  uh1jí  hjê  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h KèhjÖ  ubeh}”(h]”jŠ  ah ]”h"]”Œ1”ah$]”h&]”j„  aj‹  jŒ  uh1jÔ  hŸh³h Kèhj_  hžhj  KubjÕ  )”}”(hŒ https://lwn.net/Articles/742164/”h]”(jÛ  )”}”(hŒ2”h]”hŒ2”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÚ  hj
  ubhÊ)”}”(hj  h]”jî  )”}”(hj  h]”hŒ https://lwn.net/Articles/742164/”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j  uh1jí  hj  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Kéhj
  ubeh}”(h]”j¡  ah ]”h"]”Œ2”ah$]”h&]”jœ  aj‹  jŒ  uh1jÔ  hŸh³h Kéhj_  hžhj  KubjÕ  )”}”(hŒFhttp://lists.infradead.org/pipermail/lede-dev/2018-January/010830.html”h]”(jÛ  )”}”(hŒ3”h]”hŒ3”…””}”(hj>  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÚ  hj:  ubhÊ)”}”(hj<  h]”jî  )”}”(hj<  h]”hŒFhttp://lists.infradead.org/pipermail/lede-dev/2018-January/010830.html”…””}”(hjO  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”j<  uh1jí  hjL  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Kêhj:  ubeh}”(h]”jµ  ah ]”h"]”Œ3”ah$]”h&]”j°  aj‹  jŒ  uh1jÔ  hŸh³h Kêhj_  hžhj  KubjÕ  )”}”(hŒFhttp://lists.infradead.org/pipermail/lede-dev/2018-January/010829.html”h]”(jÛ  )”}”(hŒ4”h]”hŒ4”…””}”(hjn  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”uh1jÚ  hjj  ubhÊ)”}”(hjl  h]”jî  )”}”(hjl  h]”hŒFhttp://lists.infradead.org/pipermail/lede-dev/2018-January/010829.html”…””}”(hj  hžhhŸNh Nubah}”(h]”h ]”h"]”h$]”h&]”Œrefuri”jl  uh1jí  hj|  ubah}”(h]”h ]”h"]”h$]”h&]”uh1hÉhŸh³h Këhjj  ubeh}”(h]”jÉ  ah ]”h"]”Œ4”ah$]”h&]”jÄ  aj‹  jŒ  uh1jÔ  hŸh³h Këhj_  hžhj  Kubeh}”(h]”Œmore-reading”ah ]”h"]”Œmore reading”ah$]”h&]”uh1h´hh¶hžhhŸh³h Káubeh}”(h]”Œ$netfilter-s-flowtable-infrastructure”ah ]”h"]”Œ$netfilter's flowtable infrastructure”ah$]”h&]”uh1h´hhhžhhŸh³h Kubeh}”(h]”h ]”h"]”h$]”h&]”Œsource”h³uh1hŒcurrent_source”NŒcurrent_line”NŒsettings”Œdocutils.frontend”ŒValues”“”)”}”(h¹NŒ	generator”NŒ	datestamp”NŒsource_link”NŒ
source_url”NŒtoc_backlinks”Œentry”Œfootnote_backlinks”KŒsectnum_xform”KŒstrip_comments”NŒstrip_elements_with_classes”NŒstrip_classes”NŒreport_level”KŒ
halt_level”KŒexit_status_level”KŒdebug”NŒwarning_stream”NŒ	traceback”ˆŒinput_encoding”Œ	utf-8-sig”Œinput_encoding_error_handler”Œstrict”Œoutput_encoding”Œutf-8”Œoutput_encoding_error_handler”jÍ  Œerror_encoding”Œutf-8”Œerror_encoding_error_handler”Œbackslashreplace”Œlanguage_code”Œen”Œrecord_dependencies”NŒconfig”NŒ	id_prefix”hŒauto_id_prefix”Œid”Œdump_settings”NŒdump_internals”NŒdump_transforms”NŒdump_pseudo_xml”NŒexpose_internals”NŒstrict_visitor”NŒ_disable_config”NŒ_source”h³Œ_destination”NŒ_config_files”]”Œ7/var/lib/git/docbuild/linux/Documentation/docutils.conf”aŒfile_insertion_enabled”ˆŒraw_enabled”KŒline_length_limit”M'Œpep_references”NŒpep_base_url”Œhttps://peps.python.org/”Œpep_file_url_template”Œpep-%04d”Œrfc_references”NŒrfc_base_url”Œ&https://datatracker.ietf.org/doc/html/”Œ	tab_width”KŒtrim_footnote_reference_space”‰Œsyntax_highlight”Œlong”Œsmart_quotes”ˆŒsmartquotes_locales”]”Œcharacter_level_inline_markup”‰Œdoctitle_xform”‰Œdocinfo_xform”KŒsectsubtitle_xform”‰Œimage_loading”Œlink”Œembed_stylesheet”‰Œcloak_email_addresses”ˆŒsection_self_link”‰Œenv”NubŒreporter”NŒindirect_targets”]”Œsubstitution_defs”}”Œsubstitution_names”}”Œrefnames”}”(Œ1”]”jz  aŒ2”]”j’  aŒ3”]”j¦  aŒ4”]”jº  auŒrefids”}”Œnameids”}”(j§  j¤  jS  jP  jÀ  j½  jõ  jò  jF  jC  j‰  j†  jè  jå  j\  jY  jŸ  jœ  j  jŠ  j7  j¡  jg  jµ  j—  jÉ  uŒ	nametypes”}”(j§  ‰jS  ‰jÀ  ‰jõ  ‰jF  ‰j‰  ‰jè  ‰j\  ‰jŸ  ‰j  ˆj7  ˆjg  ˆj—  ˆuh}”(j¤  h¶jP  hÙj½  jV  jò  jÃ  jC  jø  j†  jI  jå  jŒ  jY  jë  jœ  j_  j„  jz  jœ  j’  j°  j¦  jÄ  jº  jŠ  jÖ  j¡  j
  jµ  j:  jÉ  jj  uŒfootnote_refs”}”(j  ]”jz  aj  ]”j’  aj  ]”j¦  aj  ]”jº  auŒcitation_refs”}”Œautofootnotes”]”Œautofootnote_refs”]”Œsymbol_footnotes”]”Œsymbol_footnote_refs”]”Œ	footnotes”]”(jÖ  j
  j:  jj  eŒ	citations”]”Œautofootnote_start”KŒsymbol_footnote_start”K Œ
id_counter”Œcollections”ŒCounter”“”}”jÛ  Ks…”R”Œparse_messages”]”Œtransform_messages”]”Œtransformer”NŒinclude_log”]”Œ
decoration”Nhžhub.