Re: 10g IPsec ?

2019-11-06 Thread Eugene Grosbein
07.11.2019 14:32, John-Mark Gurney wrote: > Don't we have the option of doing soft re-classification? Where we > recalculate the hash, and then do a netisr defer? I mean that'd burn > a bunch of extra cpu cycles, but you gotta do what you gotta do. If the host got a packet already, it can just

Re: 10g IPsec ?

2019-11-06 Thread John-Mark Gurney
Lawrence Stewart wrote this message on Thu, Nov 07, 2019 at 13:04 +1100: > On 7/11/19 12:52 pm, Eugene Grosbein wrote: > > 07.11.2019 8:36, Lawrence Stewart wrote: > > > AES-GCM can run at over 1GB/sec on a single core, so as long as the > traffic can be processed by multiple threads (vi

Re: 10g IPsec ?

2019-11-06 Thread Lawrence Stewart
On 7/11/19 12:52 pm, Eugene Grosbein wrote: > 07.11.2019 8:36, Lawrence Stewart wrote: > AES-GCM can run at over 1GB/sec on a single core, so as long as the traffic can be processed by multiple threads (via multiple queues for example), it should be doable. >>> I didn't be

Re: 10g IPsec ?

2019-11-06 Thread Eugene Grosbein
07.11.2019 8:36, Lawrence Stewart wrote: >>> AES-GCM can run at over 1GB/sec on a single core, so as long as the >>> traffic can be processed by multiple threads (via multiple queues >>> for example), it should be doable. >>> >>> >> I didn't bench this setup (10Gb/s IPSec) but I believe we will ha

Re: 10g IPsec ?

2019-11-06 Thread Lawrence Stewart
On 6/11/19 9:45 am, Olivier Cochard-Labbé wrote: > On Tue, Nov 5, 2019 at 8:15 PM John-Mark Gurney wrote: > >> AES-GCM can run at over 1GB/sec on a single core, so as long as the >> traffic can be processed by multiple threads (via multiple queues >> for example), it should be doable. >> >> > I d

Jails with VIMAGE and VLANS.

2019-11-06 Thread Santiago Martinez
Hi everyone, how you are doing well. During the last months, I have been working with JAIL and VIMAGE to perform some network test/validations. I have been facing the following weird behaviour that while it has been happening before, it used to be once in a while but now it is happening almos

[Bug 240135] Correctness issue in IPv6 extension headers input processing routines

2019-11-06 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=240135 Bjoern A. Zeeb changed: What|Removed |Added Status|New |Open Assignee|n...@free

Re: 10g IPsec ?

2019-11-06 Thread Muenz, Michael
Am 06.11.2019 um 13:03 schrieb Eugene Grosbein: 06.11.2019 18:29, Muenz, Michael wrote: Am 06.11.2019 um 01:21 schrieb Eugene Grosbein: 06.11.2019 4:55, Muenz, Michael wrote: These were my short results via OPNsense on 4 year old XEONs. So its 11.2, mostly untuned and strongswan as IPsec imp

Re: 10g IPsec ?

2019-11-06 Thread Victor Gamov
On 06/11/2019 01:45, Olivier Cochard-Labbé wrote: On Tue, Nov 5, 2019 at 8:15 PM John-Mark Gurney wrote: AES-GCM can run at over 1GB/sec on a single core, so as long as the traffic can be processed by multiple threads (via multiple queues for example), it should be doable. I didn't bench

Re: 10g IPsec ?

2019-11-06 Thread Eugene Grosbein
06.11.2019 18:29, Muenz, Michael wrote: > Am 06.11.2019 um 01:21 schrieb Eugene Grosbein: >> 06.11.2019 4:55, Muenz, Michael wrote: >> >>> These were my short results via OPNsense on 4 year old XEONs. >>> So its 11.2, mostly untuned and strongswan as IPsec implementation. >>> If you need more deta

Re: 10g IPsec ?

2019-11-06 Thread Muenz, Michael
Am 06.11.2019 um 01:21 schrieb Eugene Grosbein: 06.11.2019 4:55, Muenz, Michael wrote: These were my short results via OPNsense on 4 year old XEONs. So its 11.2, mostly untuned and strongswan as IPsec implementation. If you need more detailed specs just drop me a line. https://www.routerperfor