Re: DAWG for IPFW2/IPF

2002-10-09 Thread Luigi Rizzo
On Wed, Oct 09, 2002 at 07:47:30PM -0700, Michael C. Wu wrote: > Hi Luigi and Darren, > > Regarding IPFW2 and IPF, do you have plans on implementing a DAWG algorithm > for the pattern matching? (Directed Acyclic Word Graphs) my quick answer is no -- it might be interesting stuff, but have t

DAWG for IPFW2/IPF

2002-10-09 Thread Michael C. Wu
Hi Luigi and Darren, Regarding IPFW2 and IPF, do you have plans on implementing a DAWG algorithm for the pattern matching? (Directed Acyclic Word Graphs) http://citeseer.nj.nec.com/crochemore99fast.html It is a new algorithm that does super fast multiple stream/pattern matching in a

Re: in-kernel traffic generator?

2002-10-09 Thread Julian Elischer
On Wed, 9 Oct 2002, Lars Eggert wrote: > Hi, > > anyone know of an in-kernel traffic generator similar to UDPgen > >(http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) > > for Linux? Userland traffic generators have high overheads with small > packets at

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
On Thu, Oct 10, 2002 at 11:18:42AM +1000, Christopher Smith wrote: ... > Ok, so any of the network benching products that can spit out a stream of > UDP traffic should suffice ? i presume so, yes. I have some tweaks in the kernel to duplicate packets in the kernel and get higher peak rates, but t

Re: in-kernel traffic generator?

2002-10-09 Thread Lars Eggert
Garrett Wollman wrote: > < said: > >>anyone know of an in-kernel traffic generator similar to UDPgen >>(http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) > >>for Linux? Userland traffic generators have high overheads with small >>packets at Gigabit speeds. >

in-kernel traffic generator?

2002-10-09 Thread Garrett Wollman
< said: > anyone know of an in-kernel traffic generator similar to UDPgen > >(http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) > > for Linux? Userland traffic generators have high overheads with small > packets at Gigabit speeds. I wrote one a long time a

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 10:00 AM, "Luigi Rizzo" <[EMAIL PROTECTED]> wrote: > On Thu, Oct 10, 2002 at 09:38:40AM +1000, Christopher Smith wrote: > ... >> With the 2.4GHz 2650 we have currently, er, "borrowed" to do some testing >> with, the load is down to 35% or so (highest I've seen it is 40%) and the >> pa

in-kernel traffic generator?

2002-10-09 Thread Lars Eggert
Hi, anyone know of an in-kernel traffic generator similar to UDPgen (http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) for Linux? Userland traffic generators have high overheads with small packets at Gigabit speeds. (If not, netgraph should allow an easy wa

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 9:26 AM, "Andre Oppermann" <[EMAIL PROTECTED]> wrote: [chomp] > He probably can't tell because of the 32bit ifstats counters. They > wrap every other minute on a well loaded Gigabit card. A 'systat -ip 1' shows rates ranging from 120kpps to 250kpps, averaging around the 150 - 180 ra

Re: High interrupt load on firewalls

2002-10-09 Thread Andre Oppermann
Luigi Rizzo wrote: > > my general attitude is that when you are hitting 100% cpu > utilization, small performance improvements such as those > deriving from m_getcl() are not relevant, and you might > want to restructure your sw in order to get substantial > performance improvements. > > In the

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 9/10/2002 6:20 PM, "Attila Nagy" <[EMAIL PROTECTED]> wrote: > Hello, [chomp] > and > sys/kern/kern_poll.c: > [...] > #ifdef SMP > #include "opt_lint.h" > #ifndef COMPILING_LINT > #error DEVICE_POLLING is not compatible with SMP > #endif > #endif > [...] > > (no SMP support) This I can live

Re: Q about sbin/ip6fw/ip6fw.c:list()

2002-10-09 Thread Luigi Rizzo
On Mon, Oct 07, 2002 at 11:29:50PM +0300, Andrey Simonenko wrote: > Hello, > > Why is it not allowed to get more that 65536 ip6fw rules from the kernel > in the ip6fw.c:list() function? i think it is just an oversight -- perhaps the author though that each rule had to have its own number.

Routing from an Interface to an Alias

2002-10-09 Thread Jon-Erik Lido
I'm trying to something a little bizarre with routing, so I suppose it bears some explanation. I recently purchased one of those all-in-one firewall/NAT/ethernet switch/801.11b access point boxes for my home use. 802.11b security being what it is (useless), I'm planning on setting up IPSec for my

Re: High interrupt load on firewalls

2002-10-09 Thread Lars Eggert
Luigi Rizzo wrote: > than move to a different board, or use polling (i have polling > patches for the intel gigabit adapter) If you mean em(4) - I'd love to test them :-) Lars -- Lars Eggert <[EMAIL PROTECTED]> USC Information Sciences Institute smime.p7s Description: S/MIME Crypto

Re: How to get hardware address of a machine using ARP/Sysctl/Routingsockets??

2002-10-09 Thread Lars Eggert
yatin chalke wrote: > > I want to get hardware address of any machine on a > subnet using sysctl and routing sockets. > I can search arp cache and return the hardware address > if it is there. I'm not 100% sure I understand what you want to do, but using nmap (or similar) to scan the subnet sho

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the specific case, at least reading from

Re: VPN Tunneling

2002-10-09 Thread Peter Pentchev
On Wed, Oct 09, 2002 at 08:37:30AM -0600, Andy wrote: > > >On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: > >Hello, > > > >I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K > >Machine. My configuration is: > > > >{Net1} <---> <--...--> <---> {Net2} > > > >

Re: VPN Tunneling

2002-10-09 Thread Andy
>On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: >Hello, > >I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K >Machine. My configuration is: > >{Net1} <---> <--...--> <---> {Net2} > >Win2k machine has dynamically assigned IP address as it's connecting to >p

How to get hardware address of a machine using ARP/Sysctl/Routing sockets??

2002-10-09 Thread yatin chalke
Hi, I want to get hardware address of any machine on a subnet using sysctl and routing sockets. I can search arp cache and return the hardware address if it is there. But if the hardware address is not in ARP cache then I cant retrieve it. Is there any way to get hardware address of any machine

Re: Sympatico ADSL connection through a hub

2002-10-09 Thread Damian Gerow
For archival purposes... He has a DLink router, which was handling the PPPoE itself, and using DHCP for the LAN behind it. We took out the PPP configuration, put in DHCP (ifconfig_dc0="DHCP"), and it's all up and running. - Damian To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubsc

Re: VPN Tunneling

2002-10-09 Thread Peter Pentchev
On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: > Hello, > > I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K > Machine. My configuration is: > > {Net1} <---> <--...--> <---> {Net2} > > Win2k machine has dynamically assigned IP address as it's connecting

VPN Tunneling

2002-10-09 Thread Ivailo Tanusheff
Hello, I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K Machine. My configuration is: {Net1} <---> <--...--> <---> {Net2} Win2k machine has dynamically assigned IP address as it's connecting to public ISP. Can you help me build the tunnel? Regards, Ivailo Tanusheff To

Re: High interrupt load on firewalls

2002-10-09 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: > No, we use IPFilter (and that definitely isn't going to change any time > soon). Oh. Hm, maybe IPFilter 4.0 will be faster. What you might consider doing is profiling the kernel on your test system to see where the majority of the cpu time is g

Re: High interrupt load on firewalls

2002-10-09 Thread Attila Nagy
Hello, > You might want to try out some of the Intel gigabit boards. At least > we've got an engineer from Intel who maintains the driver. I'm far from being a FreeBSD expert, but Luigi Rizzo's polling patch helped me a lot in similar cases to get better performance. >From POLLING(4): DESCRIPTI