Ever since I wrote the book, RouterOS by Example, I get a lot of emails asking me specific questions about this powerful routing system.  I try and answer the questions, time allowing, as completely as possible.  There is one question that seems to pop up from time to time so I thought it was worth dedicating a blog post to it.

I you are not familiar with the Mangle facility in MikroTik RouterOS, it is a system that allows you to identify traffic and mark it.  The identification criteria can be port, protocol, source address or destination address among other things.  Once traffic is identified, a mark is associated with the packet and that packet can then be queued, firewalled, nat’ted, etc.  to name a few uses.

The question was asked this morning, “Why does everyone suggest marking connections first and then marking packets? Wouldn’t it take less processor power to simply identify and mark the packets with one rule?  Good question so let’s explore that.

If you are in a hurry or have a very simple setup, or if for some reason you have connection tracking turned off, then you can simply mark packets without marking connections.  Although this is quick and dirty, it requires that the router examine every packet that passes through the router and determine if it meets our matching criteria of our one rule.  If you only have a few rules and it works the way you want, then this is probably fine.

For more complicated setups with many rules, this simplistic method will bring a small router to it’s knees by utilizing a huge amount of CPU.  In this case, the best strategy is to first identify the traffic and then mark the connections.

Once the connections are identified and marked, simply mark all packets that belong to that connection.  This is all about numbers so take a look at an example.  My home router currenty shows 118 connections and since I have started writing this post, it has processed more than 13,000 packets.  If you were marking packets only, then the router would have had to examine 13,000 packets to determine if there was a match.  I you use the two step method, it would examine less than 200 connections for a match and then mark only the assiciated packets.  Marking packets in itself is not processor intensive but examining them for a match is.  So, in this case, more rules means less resources.

There is a hidden benefit to marking connections first with respect to troubleshooting.  When you only mark packets, you don’t get a visual feedback about your effectiveness in rule writing.  Yes, the statistics for that rule will increase if you are matching packets, but there is no way to actually see the marks.  On the other hand, if you mark connections first, you will see those marks in the connection tracking table. For me, that in itself is worth the little bit of extra effort.

I hope this helps and happy mangling!