Hi, On Fri, Jan 03, 2014 at 11:57:31AM +0000, Phil Mayers wrote: > It would be interesting to see some real-world numbers on this, to see > if it is a win or not. As I say, my gut says no, but gut != proof ;o)
Well, my "real world" numbers on FreeBSD+unbound+pf are: if I enable
state tracking in pf, it will about double CPU usage.
The system in question did not have much CPU to spare, so this led to
DNS queries sometimes being dropped, which resulted in poor user
experience.
(The change to keep state was not intentional - it came as a side effect
of a FreeBSD update, I think 6->7, which changed the default in pf.conf
from 'no state' to 'keep state', if not specified explicitely)
gert
--
USENET is *not* the non-clickable part of WWW!
//www.muc.de/~gert/
Gert Doering - Munich, Germany [email protected]
fax: +49-89-35655025 [email protected]
pgp1vaXGFm6Bv.pgp
Description: PGP signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
