Re: High interrupt load on firewalls

2002-10-18 Thread David Miller
On Fri, 18 Oct 2002, Luigi Rizzo wrote: > On Fri, Oct 18, 2002 at 12:59:27PM -0400, David Miller wrote: > > On Wed, 9 Oct 2002, Attila Nagy wrote: > > > > With a dc ethernet card and ~45K packets per second, an XP1700 system went > > from > 50% interrupt to < 1%. I was astounded at the change!

Re: High interrupt load on firewalls

2002-10-18 Thread Luigi Rizzo
On Fri, Oct 18, 2002 at 12:59:27PM -0400, David Miller wrote: > On Wed, 9 Oct 2002, Attila Nagy wrote: > > With a dc ethernet card and ~45K packets per second, an XP1700 system went > from > 50% interrupt to < 1%. I was astounded at the change! that is partly cheating, because with polling, some

Re: High interrupt load on firewalls

2002-10-18 Thread David Miller
On Wed, 9 Oct 2002, Attila Nagy wrote: With a dc ethernet card and ~45K packets per second, an XP1700 system went from > 50% interrupt to < 1%. I was astounded at the change! If all it takes to get Gb interfaces polling is to send Luigi a card then he needs to send me his shipping address:) ---

[PATCH: if_ti] Re: High interrupt load on firewalls

2002-10-11 Thread Terry Lambert
Mike Silbersack wrote: > On Wed, 9 Oct 2002, Christopher Smith wrote: > > The rule processing can't be done on the other CPU, can it ? Am I right in > > saying that at this point in time, buying a dual CPU (vs single CPU) machine > > for firewalling with FreeBSD is just a waste of money ? > > Eve

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
On Thu, Oct 10, 2002 at 11:18:42AM +1000, Christopher Smith wrote: ... > Ok, so any of the network benching products that can spit out a stream of > UDP traffic should suffice ? i presume so, yes. I have some tweaks in the kernel to duplicate packets in the kernel and get higher peak rates, but t

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 10:00 AM, "Luigi Rizzo" <[EMAIL PROTECTED]> wrote: > On Thu, Oct 10, 2002 at 09:38:40AM +1000, Christopher Smith wrote: > ... >> With the 2.4GHz 2650 we have currently, er, "borrowed" to do some testing >> with, the load is down to 35% or so (highest I've seen it is 40%) and the >> pa

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 9:26 AM, "Andre Oppermann" <[EMAIL PROTECTED]> wrote: [chomp] > He probably can't tell because of the 32bit ifstats counters. They > wrap every other minute on a well loaded Gigabit card. A 'systat -ip 1' shows rates ranging from 120kpps to 250kpps, averaging around the 150 - 180 ra

Re: High interrupt load on firewalls

2002-10-09 Thread Andre Oppermann
Luigi Rizzo wrote: > > my general attitude is that when you are hitting 100% cpu > utilization, small performance improvements such as those > deriving from m_getcl() are not relevant, and you might > want to restructure your sw in order to get substantial > performance improvements. > > In the

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 9/10/2002 6:20 PM, "Attila Nagy" <[EMAIL PROTECTED]> wrote: > Hello, [chomp] > and > sys/kern/kern_poll.c: > [...] > #ifdef SMP > #include "opt_lint.h" > #ifndef COMPILING_LINT > #error DEVICE_POLLING is not compatible with SMP > #endif > #endif > [...] > > (no SMP support) This I can live

Re: High interrupt load on firewalls

2002-10-09 Thread Lars Eggert
Luigi Rizzo wrote: > than move to a different board, or use polling (i have polling > patches for the intel gigabit adapter) If you mean em(4) - I'd love to test them :-) Lars -- Lars Eggert <[EMAIL PROTECTED]> USC Information Sciences Institute smime.p7s Description: S/MIME Crypto

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the specific case, at least reading from

Re: High interrupt load on firewalls

2002-10-09 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: > No, we use IPFilter (and that definitely isn't going to change any time > soon). Oh. Hm, maybe IPFilter 4.0 will be faster. What you might consider doing is profiling the kernel on your test system to see where the majority of the cpu time is g

Re: High interrupt load on firewalls

2002-10-09 Thread Attila Nagy
Hello, > You might want to try out some of the Intel gigabit boards. At least > we've got an engineer from Intel who maintains the driver. I'm far from being a FreeBSD expert, but Luigi Rizzo's polling patch helped me a lot in similar cases to get better performance. >From POLLING(4): DESCRIPTI

Re: High interrupt load on firewalls

2002-10-08 Thread Julian Elischer
On Wed, 9 Oct 2002, Christopher Smith wrote: > On 9/10/02 3:07 PM, "Mike Silbersack" <[EMAIL PROTECTED]> wrote: > > > > > > > On Wed, 9 Oct 2002, Christopher Smith wrote: > > > >> We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 > >> (ti driver) fibre cards with abo

Re: High interrupt load on firewalls

2002-10-08 Thread Christopher Smith
On 9/10/02 3:07 PM, "Mike Silbersack" <[EMAIL PROTECTED]> wrote: > > > On Wed, 9 Oct 2002, Christopher Smith wrote: > >> We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 >> (ti driver) fibre cards with about 7 vlans spread across them. Both these >> machines run at *v

Re: High interrupt load on firewalls

2002-10-08 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: > We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 > (ti driver) fibre cards with about 7 vlans spread across them. Both these > machines run at *very* high interrupt loads (95 - 100% during business hours > (mostly 100%), 8

Re: High interrupt load on firewalls

2002-10-08 Thread Kenneth D. Merry
[ taking -questions out of the CC list, please don't send things to more than 2 lists, the mail servers don't usually allow it in any case. ] On Wed, Oct 09, 2002 at 13:41:38 +1000, Christopher Smith wrote: > We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 > (ti driver)

High interrupt load on firewalls

2002-10-08 Thread Christopher Smith
We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 (ti driver) fibre cards with about 7 vlans spread across them. Both these machines run at *very* high interrupt loads (95 - 100% during business hours (mostly 100%), 80 - 90 % during off hours). They are 1GHz P3 machines (