Le jeudi 30 septembre 2010 à 16:30 +0400, Alexey Vlasov a écrit :

On Wed, Sep 29, 2010 at 11:45:21PM +0200, Eric Dumazet wrote:

quoted

But if you send SYN packets in the same time, (logged), this might
slow
down the reception (and answers) of ICMP frames. LOG target can be
quite
expensive...

Yes, it's clear that  some slow down can appear, but 100 ms is too much,
and this happens at 200 SYN packets in 2 minutes just as in my example.
On old servers where some tx/rx are missing in NIC card I don't see
such a situation even at more then 1000 SYN-packets per sec.

Because all cpus were servicing interrupts, which was good for your
needs. Things apparently changed with 2.6.32. 

You have a multiqueue NIC, but using a single CPU to handle the
workload.

quoted

Is using other rules gives same problem ?

iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags

No, only LOG gives such a scheme.