Is any rules checking optimization is exists in Mikrotik?
Sample:
Two interfaces 1 and 2.
Big traffic flow from 1. Small traffic flow from 2.
I need to check flow with big address list. And I know, that adresses from list can coming only from 2.
Will ROS check big traffic flow from 1 with big address list, if I’ll add in_interface=2 ? Or it’ll check 1+2 flow not only with list, but and with interface name?
I’d expect that some such optimizations do exist. Some conditions are easier to evaluate than others, so it would make sense to check easy ones first.
Unfortunately, it’s not the proof, it happened before that I expected something, because it made sense, and it turned out that I just was too optimistic. It may be possible to test it with different rules, if you generate some controlled level of traffic, see how’s the load with only difficult conditions (for example L7 filters should be bad), then add some simple condition and see if there’s any difference.
Address lists may not be too bad, they don’t check addresses one by one, but they are hashed (see ipset in Linux).
Yes, I used ipset for a long time and I understand the mechanism of its action. However, an independent search and conclusions about internal algorithms may be erroneous. I do not have a device where there would not be other rules that can lead to erroneous conclusions.
It’s not just the adress lists (it’s the sample). If you understand the order and weight of options, you can add generally insignificant options to check that would facilitate the rules load in general, and noticeably reduce the CPU load.