Latest LQ Deal: Linux Power User Bundle
Go Back > Forums > Linux Forums > Linux - Networking
User Name
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.


  Search this Thread
Old 07-24-2006, 12:04 AM   #1
Registered: Dec 2004
Posts: 125

Rep: Reputation: 15
iptables -L -v and route lag

This is something strange I am noticing on both machines i am running iptables on.

One of them doesnt do this often, but one does almost everytime. Whenever I type 'iptables -L -v' or route it seems like it stalls trying to gather the info. It takes almost 20 or 30 seconds before it prints them all out. I only have like 10 iptables rules and 3 or 4 route statements. Also I run top in another ssh session and memory usage in very low and uptime shows 0.00 across the board.

Any idea why they would struggle so much to give me output?
Old 07-24-2006, 12:47 AM   #2
Senior Member
Registered: Jul 2003
Location: Mississippi USA
Distribution: Gentoo
Posts: 2,058
Blog Entries: 2

Rep: Reputation: 79
This may help you see it is not just you:

root@smoker / # time iptables -L -v
Chain INPUT (policy ACCEPT 30M packets, 48G bytes)
pkts bytes target prot opt in out source destination
1918 115K ACCEPT tcp -- any any anywhere anywhere tcp dpt:http
4676 413K ACCEPT udp -- any any anywhere udp dpt:netbios-ns
0 0 ACCEPT tcp -- any any anywhere tcp dpt:netbios-ns
3298K 3413M ACCEPT tcp -- any any anywhere tcp dpt:netbios-ssn
0 0 ACCEPT udp -- any any anywhere udp dpt:netbios-ssn
0 0 ACCEPT tcp -- any any anywhere tcp dpt:netbios-dgm
8110 1939K ACCEPT udp -- any any anywhere udp dpt:netbios-dgm
26688 23M ACCEPT tcp -- any any anywhere tcp dpt:microsoft-ds
0 0 ACCEPT udp -- any any anywhere udp dpt:microsoft-ds
1330 349K DROP all -- eth0 any anywhere anywhere state INVALID,NEW

Chain FORWARD (policy ACCEPT 1028K packets, 906M bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- eth0 any anywhere anywhere state INVALID,NEW

Chain OUTPUT (policy ACCEPT 32M packets, 30G bytes)
pkts bytes target prot opt in out source destination

real 4m42.376s
user 0m0.128s
sys 0m0.012s
root@smoker / #
That took mine almost 5 minutes to run the exact command you gave. From my understanding it is the way it runs the command. It actually looks to find which ones are open instead of just seeing which ones are supposed to be open. In other words, it tests each port instead of just reading some config file. That is how I understood it when I read it somewhere a few weeks ago.

Hope that helps.

Old 07-24-2006, 12:54 AM   #3
Registered: Aug 2004
Location: The Netherlands
Distribution: RedHat 2, 3, 4, 5, Fedora, SuSE, Gentoo
Posts: 372

Rep: Reputation: 42
Try the -n option for both iptables and route. My (fairly certain) guess is that it is looking up hostnames for the IPs, and if it cannot find the hostname, it stalls..

try 'iptables -L -nv' and 'route -n'. It disables name lookups.
Old 07-24-2006, 06:51 AM   #4
Senior Member
Registered: Oct 2004
Location: Houston, TX (usa)
Distribution: MEPIS, Debian, Knoppix,
Posts: 4,727
Blog Entries: 15

Rep: Reputation: 234Reputation: 234Reputation: 234
I agree that the extra time is taken to look up the host names.

I tried the same test on my firewall; & while it was much faster than yours, 5 sec. vs. 5 min., it was also even faster using the -n option: "0m0.088s". The firewall box is an only slightly tweaked SmoothWall Express 2, & has 115 rules which generate 131 lines of -L output.

BTW, the 1st tweak to my "Smoothie" was to put all the hosts on my LAN in its /etc/hosts file. Because SmoothWall Express uses dnsmasq, this results in those associations being part of the (local) DNS for the entire LAN. In other words, the Smoothie's /etc/hosts file becomes the master hosts file for the whole network. So iptables & route run relatively quickly.

Do you have "fixed" (either true static or statically assigned through DHCP) IP's on your LAN? If so, try putting those assignments in the /etc/hosts file of the box that is always slow to return output. If you like the result, then look at the various strategies to do it LAN-wide.
Old 07-24-2006, 07:12 PM   #5
Registered: Dec 2004
Posts: 125

Original Poster
Rep: Reputation: 15
The -n option helped alot. Also I had been lazy before and had dns pointed to one of my isp dns servers and last night I set up bind to server internal hosts.

Thanks for your replies.


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
I am not able to add a new route to my route table using route command prashanth s j Linux - Networking 2 09-03-2005 04:34 AM
ADSL as a Alternate route or backup route bhagat2000 Linux - Networking 0 05-27-2004 03:17 PM
Iptables Need It To Route To A Windows Machine For Remote Desktop sal_paradise42 Linux - General 2 11-11-2003 08:20 PM
STATIC Route using IPTables Milkman00 Linux - Networking 3 03-06-2003 07:47 PM
Working with 'route' and unwanted route entries pioniere Linux - Networking 6 02-05-2003 12:14 PM > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 12:44 AM.

Main Menu
Write for LQ is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration