Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm capturing all the incoming/outgoing packets in my system(Linux). I'm using ulogd tool to do that. All the packets flow through IP table rules, and logging happens. My understanding is that logger takes some time to log the packets, and it becomes part of network latency. Is it correct? ( I did a basic ping test to the localhost with ulogd packet capturing/without ulogd packet capturing, and measured the rtt min/avg/max/mdev. I saw .006 ms difference between test(with ulogd) and test(without ulogd).

Does flow based logging avoids this kind of network latency in general? (Not specific to ulogd tool)

share|improve this question
up vote 1 down vote accepted

In general, no. Mere logging doesn't delay the delivery of the packet as the logging can be completed after the packet has been delivered. Only actions that require making a decision that affects what happens to the packet require a delay in forwarding/routing.

share|improve this answer
Thanks. Consider the NFLOG target in IP tables. Man page on iptables says, a rule with NFLOG as a target is a non terminating target, and I have a question here. A packet that matches this NFLOG target, and will the iptables immediately return to the next rule in the iptables chain, or it will wait for NFLOG to finish its execution? – Goms Jul 24 '12 at 23:17
It will wait for the NFLOG rule to finish its execution. But that's finished as soon as the dispatch to the virtual device is finished. It doesn't have to wait for the actual logging to take place. – David Schwartz Jul 24 '12 at 23:24
Thanks again, I understand that iptables will not wait for logging to take place. Have one question what do you mean by 'dispatch to the virtual device' – Goms Jul 24 '12 at 23:31
The way NFLOG works is that there's a virtual device that links the networking code to the logging code. The rule dispatches information to the virtual device and the logging code picks it up later and logs it. It kind of acts like a mailbox. – David Schwartz Jul 24 '12 at 23:32
Wow, I'm clear now. Unfortunately I'm not able to find a clear documentation on how NFLOG works. Just got bits and pieces of NFLOG. – Goms Jul 24 '12 at 23:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.