Netfilter and performance

Hello,

In an effort to optimize my rule generating script, I came to a point where I wonder about the internal workings of iptables and about which is faster and what not. Maybe you guys can help me out with the 3 scenarios I wonder about:

First:

What is faster. Matching "-m state --state NEW" or "-m mark --mark 1" for every packet? Probably makes no or little difference, or?

Second in an extra chain of the mangle table:

many_matches -j MARK --set-mark i
-m mark --mark i -j RETURN
many_matches -j MARK --set-mark j
-m mark --mark j -j RETURN
more like these for an undefined number of times

or

many_matches -m mark ! --mark 0/0 -j MARK --set-mark i many_matches -m mark ! --mark 0/0 -j MARK --set-mark j more like these for an undefined number of times

So here we have one extra rule per match with the advantage to skip the rest of the rules as soon as one packet is marked vs one extra rule per match without the possibility to skip the rest of the matches.

And third, also in an extra chain of the mangle table:

many_matches -j CLASSIFY --set-class i:j
same_as_above_matches -j RETURN
many_matches -j CLASSIFY --set-class n:m
same_as_above_matches b match b -j RETURN
more like these for an undefined number of times

or

many_matches -j MARK --set-mark i
-m mark i -j RETURN
tc filter add ... handle i fw flowid n:m
many_matches -j MARK --set-mark j
-m mark j -j RETURN
tc filter add ... handle j fw flowid o:p
more like these for an undefined number of times

Thanks for your help

- Jörg Lübbert