This place needs more of this kind of documentation. I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sense, everything I did was brittle. Until I finally found a schematic showing the flowchart of a packet through the kernel, which gives the exact order that each rule chain is applied, and where some of the sysctl values are enforced. All of a sudden, I could write…
Was it this one? https://en.wikipedia.org/wiki/File%3aNetfilter-packet-flow.s...
Entire Linux Network stack diagram (2024)
41–50 of 61 posts
Re: Entire Linux Network stack diagram (2024)
#42*simplified. Doesn't even go into iptables/nftables
Re: Entire Linux Network stack diagram (2024)
#43Fools admire complexity.
Re: Entire Linux Network stack diagram (2024)
#44Earlier quoted context omitted.
It's more of a netfilter (the thing behind iptables and nftables) diagram rather than just iptables. If you know how iptables maps to that diagram you are very likely to be able to quickly understand how nftables does too.
Sure, but we really shouldn’t be encouraging the use of iptables in 2025.
Soooo many systems are still using iptables even though we "should" be using nft everywhere.
If you're going to be a Linux Sys/Net Admin today, you need an understanding of both systems.
Re: Entire Linux Network stack diagram (2024)
#45Earlier quoted context omitted.
Do you know if there is a English version of the book?
If the author agrees, I could try to learn Serbo-Croatian (I'm Polish, good with languages) and translate it to English. I'm kinda a burnout Linux geek, who cannot look at computers much more. Translating a book would be fun, but I would need some sponsoring. Amadeusz at [the old name of icloud].com
Re: Entire Linux Network stack diagram (2024)
#46Earlier quoted context omitted.
Sure, but we really shouldn’t be encouraging the use of iptables in 2025.
That's not realalistic for most of the Linux world. Soooo many systems are still using iptables even though we "should" be using nft everywhere. If you're going to be a Linux Sys/Net Admin today, you need an understanding of both systems.
Re: Entire Linux Network stack diagram (2024)
#47Re: Entire Linux Network stack diagram (2024)
#48This place needs more of this kind of documentation. I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sense, everything I did was brittle. Until I finally found a schematic showing the flowchart of a packet through the kernel, which gives the exact order that each rule chain is applied, and where some of the sysctl values are enforced. All of a sudden, I could write…
Was it this one? https://en.wikipedia.org/wiki/File%3aNetfilter-packet-flow.s...
And the answer is it doesn't do NAT. The code is already preparing to do NAT, and that code merely consults the table to find out what kind of NAT it should do. The diagram makes it look like you can just move a NAT rule to a filter or mangle rule because the kernel just applies these tables in sequence anyway, but you can't because they are consulted by different blocks of code for different purposes.
Re: Entire Linux Network stack diagram (2024)
#49This place needs more of this kind of documentation. I failed to use IP tables for years. I bought books. I copied recipes from blog posts. Nothing made sense, everything I did was brittle. Until I finally found a schematic showing the flowchart of a packet through the kernel, which gives the exact order that each rule chain is applied, and where some of the sysctl values are enforced. All of a sudden, I could write…
Me too, then I discovered FreeBSD and pf tables. I _feel_ like an expert network engineer now. It took time and effort of course, but the learning process "clicked" for me all along the way and I was able to build on my understandings. Give it a try!
https://docs.freebsd.org/en/books/handbook/firewalls/
There was a recent book published on the tool, The Book of PF, 4th Edition
Re: Entire Linux Network stack diagram (2024)
#50Earlier quoted context omitted.
I think it was put pretty well by describing things as accidental complexity (of which you want as little as possible) and essential complexity, which is inherent to the problem domain that you're working with and which there is no way around for. The same thing could sometimes fall into different categories as well - like going for a microservices architecture when you need to serve about 10'000 clients in total vs…
> inherent to the problem domain that you're working with and which there is no way around for I'd phrase it to reasonable taken trade-offs for customer/user support and/or selling products. > going for a microservices architecture when you need to serve about 10'000 clients So far I am only aware of the use case to ship/release fast at cost of technical debt (non-synchronized master) of microservices. As I understan…
2. Sometimes when you have vastly different workloads, like a bunch of parts of the system (maybe even the majority) that is just a CRUD and a small part that needs to deal with message queues, or digitally sign documents, or generate reports or do any PDF/Word/Excel/whatever processing. You could do this with a modular monolith but sometimes it's better to keep the dependencies of your project clean, especially in the case of subpar libraries that you have to use, so you at least can put all of the bullshit in one place. Also applies in cases where the load/stability of that one eccentric part is under question.
3. The tech stack might also differ a whole bunch of some of those use cases, for example if you need to process all sorts of binary data formats (e.g. satellite data) or do specific kinds of number crunching, or interact with LLMs, a lot of the time Python will be a really good solution for this, while that's not what you might be using in your stack throughout. So you might pick the right tool for the job and keep it as a separate service.
4. The good old org chart, sometimes you'll just have different teams with different approaches and will be working on different parts of the business domain - you already said that, but Conway's law is very much a thing that'd be silly to fight against all that much, because then you'd end up with an awkward monorepo, the tooling to make working which easy might just not be available to you.