On Wed, Sep 29, 2010 at 11:45:21PM +0200, Eric Dumazet wrote:

But if you send SYN packets in the same time, (logged), this might
slow
down the reception (and answers) of ICMP frames. LOG target can be
quite
expensive...

Yes, it's clear that  some slow down can appear, but 100 ms is too much,
and this happens at 200 SYN packets in 2 minutes just as in my example.
On old servers where some tx/rx are missing in NIC card I don't see
such a situation even at more then 1000 SYN-packets per sec.

Is using other rules gives same problem ?

iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags

No, only LOG gives such a scheme.

-- 
BRGDS. Alexey Vlasov.