PF vs IPFW (was: Re: Firewall Profiling.)

2011-12-27 Thread Damien Fleuriot
On 12/27/11 1:54 AM, Pawel Tyll wrote: > Hi lists, > > Are there any profiling tools in the system or ports that would allow > me to determine how much processing is being done per packet and how > long does it take? I would like to predict possible PPS load for my > system and perhaps locat

Re: Firewall Profiling.

2011-12-27 Thread Luigi Rizzo
On Tue, Dec 27, 2011 at 03:00:47PM +0100, Pawel Tyll wrote: > > IPFW seems to add more or less constant overhead per rule. In our setup, > > ~20 rules increase load by 100% (one core). We are able to reach 10GE > > (1.1mpps) on some routers with most packets travelling 8-10 ipfw rules. > > However

Re: Firewall Profiling.

2011-12-27 Thread Sami Halabi
Hi, do you use dummynet? what is the server hardware configuration and tunings you did to acheive 10Gbps ? Sami On Tue, Dec 27, 2011 at 1:36 PM, Alexander V. Chernikov < melif...@freebsd.org> wrote: > On 27.12.2011 04:54, Pawel Tyll wrote: > >> Hi lists, >> >> Are there any profiling tools in t

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Warren Block
On Tue, 27 Dec 2011, Rajneesh Kumar wrote: During my development, I want to check if my modules compile successfully or not. I am only changing the ARP portion and whenever I compile my kernel, it takes around 20mins and compiles all different modules also. I just want to compile and check wheth

Re: Firewall Profiling.

2011-12-27 Thread Pawel Tyll
> a 1500-byte frame is 12k bits so you need 830 Kpps > to saturate the 10G link in one direction (and say another 450 Kpps > as acks in the other direction). Obviously, sorry. Didn't have enough sleep lately :) ___ freebsd-net@freebsd.org mailing list h

Re: Can we do perform a C style file Read/Write from within a ARP module

2011-12-27 Thread perryh
Eugene Grosbein wrote: > 27.12.2011 20:11, per...@pluto.rain.com ?: > > Jason Hellenthal wrote: > >> > >> See siftr(4). This module writes to a file. > > > > Is siftr(4) new since 8.1? > > HISTORY > SIFTR first appeared in FreeBSD 7.4 and FreeBSD 8.2. which explains why there's no man

Re: Firewall Profiling.

2011-12-27 Thread Pawel Tyll
> plans, yes - not sure how long it will take. I have compiled > ipfw+dummynet as a standalone module (outside the kernel) > but have not yet hooked the code to netmap to figure out how fast > it can run. If I understand correctly, this would require netmap to catch every packet from interfaces

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Damien Fleuriot
On 12/27/11 3:51 PM, Warren Block wrote: > On Tue, 27 Dec 2011, Rajneesh Kumar wrote: > >> During my development, I want to check if my modules compile successfully >> or not. I am only changing the ARP portion and whenever I compile my >> kernel, it takes around 20mins and compiles all differen

Re: Can we do perform a C style file Read/Write from within a ARP module

2011-12-27 Thread Rick Macklem
perryh wrote: > Jason Hellenthal wrote: > > > > See siftr(4). This module writes to a file. > > Is siftr(4) new since 8.1? > > $ man siftr > No manual entry for siftr > $ cd /usr/ports > $ ls -d */*siftr* > ls: */*siftr*: No such file or directory > You can look at: http://people.freebsd.org/

Re: ng_mppc_decompress: too many (4094) packets dropped, disabling node

2011-12-27 Thread Gleb Smirnoff
Sami, On Tue, Dec 27, 2011 at 10:42:58AM +0200, Sami Halabi wrote: S> i see in the logs many 4092, and a bit 4093 and 4094 as the log shows. S> S> I applied the both patches (the one you sent and the on on the pr) but i S> didn't load the new module yet: S> # kldunload ng_mppc S> kldunload: can

Re: Firewall Profiling.

2011-12-27 Thread Alexander V. Chernikov
On 27.12.2011 04:54, Pawel Tyll wrote: Hi lists, Are there any profiling tools in the system or ports that would allow me to determine how much processing is being done per packet and how long does it take? I would like to predict possible PPS load for my system and perhaps locate and remo

Re: ng_mppc_decompress: too many (4094) packets dropped, disabling node

2011-12-27 Thread Sami Halabi
okay, i reverted back to my original ng_mppc.c. btw: there an alternative module in here: http://www.mavhome.dp.ua/MPPC/ maybe this helps.. Sami 2011/12/27 Gleb Smirnoff > Sami, > > On Tue, Dec 27, 2011 at 10:42:58AM +0200, Sami Halabi wrote: > S> i see in the logs many 4092, and a bit 4093

Re: ng_mppc_decompress: too many (4094) packets dropped, disabling node

2011-12-27 Thread Sami Halabi
Hi, i see in the logs many 4092, and a bit 4093 and 4094 as the log shows. I applied the both patches (the one you sent and the on on the pr) but i didn't load the new module yet: # kldunload ng_mppc kldunload: can't unload file: Device busy # I'm afraid to force it so my MPD won't crash to uses

ppp.conf "set speed" && UMTS

2011-12-27 Thread Matthias Apitz
Hello, I'm using PPP with an USB UMTS stick (Huawei E1750). The speed for upload and download can be measured with, for example, pages like: http://www.speedtest.net/ the results vary of course a bit, but usually they are between 1 and 4 Mbps; how those values fit with the speed of the device /d

Re: Transitioning if_addr_lock to an rwlock

2011-12-27 Thread Ermal Luçi
2011/12/27 Gleb Smirnoff : > On Thu, Dec 22, 2011 at 11:30:01AM -0500, John Baldwin wrote: > J> You can find the patch for 8.x at > J> http://www.freebsd.org/~jhb/patches/if_addr_rwlock.patch > > Just my two pennies: for head/ patching if ip_carp.c should > be straightforward: > > 1) Using W in car

Re: Firewall Profiling.

2011-12-27 Thread Pawel Tyll
> IPFW seems to add more or less constant overhead per rule. In our setup, > ~20 rules increase load by 100% (one core). We are able to reach 10GE > (1.1mpps) on some routers with most packets travelling 8-10 ipfw rules. > However, even with ipfw add 1 allow ip from any to any > 1.1 mpps routing u

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Damien Fleuriot
On 12/27/11 7:23 AM, Rajneesh Kumar wrote: > Hi list, > > During my development, I want to check if my modules compile successfully > or not. I am only changing the ARP portion and whenever I compile my > kernel, it takes around 20mins and compiles all different modules also. > I just want to co

Re: Firewall Profiling.

2011-12-27 Thread Luigi Rizzo
On Tue, Dec 27, 2011 at 03:18:04PM +0100, Pawel Tyll wrote: > > plans, yes - not sure how long it will take. I have compiled > > ipfw+dummynet as a standalone module (outside the kernel) > > but have not yet hooked the code to netmap to figure out how fast > > it can run. > If I understand corre

Re: Transitioning if_addr_lock to an rwlock

2011-12-27 Thread Gleb Smirnoff
On Tue, Dec 27, 2011 at 11:29:02AM +0100, Ermal Lu?i wrote: E> 2011/12/27 Gleb Smirnoff : E> > On Thu, Dec 22, 2011 at 11:30:01AM -0500, John Baldwin wrote: E> > J> You can find the patch for 8.x at E> > J> http://www.freebsd.org/~jhb/patches/if_addr_rwlock.patch E> > E> > Just my two pennies: for

Re: kern/163478: [re] interface does not count bytes on interface

2011-12-27 Thread yongari
Synopsis: [re] interface does not count bytes on interface State-Changed-From-To: open->feedback State-Changed-By: yongari State-Changed-When: Tue Dec 27 18:38:15 UTC 2011 State-Changed-Why: I believe this has nothing to do with re(4). See a possible patch for vlan(4) at the following URL. http:/

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Warren Block
On Tue, 27 Dec 2011, Damien Fleuriot wrote: On 12/27/11 3:51 PM, Warren Block wrote: On Tue, 27 Dec 2011, Rajneesh Kumar wrote: During my development, I want to check if my modules compile successfully or not. I am only changing the ARP portion and whenever I compile my kernel, it takes around

Re: ng_mppc_decompress: too many (4094) packets dropped, disabling node

2011-12-27 Thread Gleb Smirnoff
On Tue, Dec 27, 2011 at 09:44:23AM +0200, Sami Halabi wrote: S> >1) Is the number always 4094? S> S> No, i see 4092, 4093 also: S> Dec 24 09:17:04 mpd2 kernel: ng_mppc_decompress: too many (4092) packets S> dropped S> , disabling node 0xff003051e400! S> Dec 24 09:17:04 mpd2 kernel: S> Dec 24 1

Re: bsnmpd not showing out octets for vlan interfaces

2011-12-27 Thread Joe Holden
YongHyeon PYUN wrote: On Mon, Dec 26, 2011 at 07:53:06PM +, Joe Holden wrote: Hi guys, Hope you're all enjoying the holiday. Is anyone using bsnmpd with vlan interfaces? I see the following: ifOutOctets.10 = Counter32: 0 ifOutOctets.11 = Counter32: 3061 ifOutOctets.12 = Counter32: 0 ifOu

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Damien Fleuriot
On 12/27/11 8:19 PM, Warren Block wrote: > On Tue, 27 Dec 2011, Damien Fleuriot wrote: >> On 12/27/11 3:51 PM, Warren Block wrote: >>> On Tue, 27 Dec 2011, Rajneesh Kumar wrote: >>> During my development, I want to check if my modules compile successfully or not. I am only changing

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Eitan Adler
On Tue, Dec 27, 2011 at 2:19 PM, Warren Block wrote: > make -j4 buildworld: Try adding -DNO_CLEAN here, > Normal  19:41 > ccache   6:02 > > make -j4 buildkernel (custom kernel): Try adding -DKERNFAST here for incremental builds. > Normal  8:43 > ccache  2:47 -- Eitan Adler _

i386 compile sys/dev/ie

2011-12-27 Thread Sean Bruno
Doing a lot of compiles recently and keep noting this noise in sys/dev/ie: /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/if_ie.c: In function 'ieget': /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/if_ie.c:682: warning: passing argument 1 of 'bcopy' discards qualifiers from pointer target t

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Warren Block
On Tue, 27 Dec 2011, Damien Fleuriot wrote: Those are best-case times. A typical ccache buildworld after csup to -stable is about 9 minutes on this system. That sounds good enough. Are there any performance hits during production, as in, when not busy rebuilding the world or whatever, just n

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Damien Fleuriot
On 27 Dec 2011, at 21:22, Warren Block wrote: > On Tue, 27 Dec 2011, Damien Fleuriot wrote: > >>> Those are best-case times. A typical ccache buildworld after csup to >>> -stable is about 9 minutes on this system. >> >> That sounds good enough. >> >> Are there any performance hits during pro

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Damien Fleuriot
On 27 Dec 2011, at 20:30, Eitan Adler wrote: > On Tue, Dec 27, 2011 at 2:19 PM, Warren Block wrote: >> make -j4 buildworld: > Try adding -DNO_CLEAN here, > I don't know, I'm ever afraid of running into whatever issues when not performing a clean full rebuild... >> Normal 19:41 >> ccache

Re: Panic in the udp_input() under heavy load

2011-12-27 Thread Maxim Sobolev
So it's actually happening: Nov 8 21:38:02 dal09 kernel: BZZT! Something is terribly wrong, up == NULL! inp = 0xff05e5798bd0 Nov 13 03:34:49 dal09 kernel: BZZT! Something is terribly wrong, up == NULL! inp = 0xff02e5b05930 Nov 30 04:18:11 dal09 kernel: BZZT! Something is terribly wrong

Re: Panic in the udp_input() under heavy load

2011-12-27 Thread Maxim Sobolev
So it's actually happening: Nov 8 21:38:02 dal09 kernel: BZZT! Something is terribly wrong, up == NULL! inp = 0xff05e5798bd0 Nov 13 03:34:49 dal09 kernel: BZZT! Something is terribly wrong, up == NULL! inp = 0xff02e5b05930 Nov 30 04:18:11 dal09 kernel: BZZT! Something is terribly wrong

Re: ng_mppc_decompress: too many (4094) packets dropped, disabling node

2011-12-27 Thread Sami Halabi
Hi Gleb, Thanks for your patch, i applied it and its production already. i had to stop mpd, and once started it i saw that all home routers connected immediatly. most of them don't use mppc, so I wonder why this problem happend in the first place. whats surprising i had few hours ago the same probl

Re: Firewall Profiling.

2011-12-27 Thread Mike Tancsa
On 12/27/2011 6:36 AM, Alexander V. Chernikov wrote: >> Is IPFW efficient enough to firewall 2x10GE (in+out) interfaces >> without much latency increase, when running on modern hardware >> with Intel NICs? Majority of processing tasks would probably be setfib >> according to matches

Re: Firewall Profiling.

2011-12-27 Thread Alexander V. Chernikov
Mike Tancsa wrote: > On 12/27/2011 6:36 AM, Alexander V. Chernikov wrote: >>> Is IPFW efficient enough to firewall 2x10GE (in+out) interfaces >>> without much latency increase, when running on modern hardware >>> with Intel NICs? Majority of processing tasks would probably be setfib

Re: Compiling only "network" part of the kernel

2011-12-27 Thread Warren Block
On Tue, 27 Dec 2011, Damien Fleuriot wrote: On 27 Dec 2011, at 20:30, Eitan Adler wrote: On Tue, Dec 27, 2011 at 2:19 PM, Warren Block wrote: make -j4 buildworld: Try adding -DNO_CLEAN here, I don't know, I'm ever afraid of running into whatever issues when not performing a clean full

Re: i386 compile sys/dev/ie

2011-12-27 Thread Sergey Kandaurov
On 27 December 2011 23:45, Sean Bruno wrote: > Doing a lot of compiles recently and keep noting this noise in > sys/dev/ie: > > > > /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/if_ie.c: In function > 'ieget': > /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/if_ie.c:682: warning: > passing ar

Re: Firewall Profiling.

2011-12-27 Thread Adrian Chadd
I can't help but remember when "someone" wrote an ipfw rule compiler - ie, take ipfw ruleset, generate C code. Maybe someone should write one and open source it this time.. :) Adrian ___ freebsd-net@freebsd.org mailing list http://lists.freebsd.org/ma

Re: Firewall Profiling.

2011-12-27 Thread Lev Serebryakov
Hello, Luigi. You wrote 27 декабря 2011 г., 18:26:00: > plans, yes - not sure how long it will take. I have compiled > ipfw+dummynet as a standalone module (outside the kernel) > but have not yet hooked the code to netmap to figure out how fast > it can run. I still don't understand why it should

Re: Firewall Profiling.

2011-12-27 Thread Lev Serebryakov
Hello, Adrian. You wrote 28 декабря 2011 г., 10:04:13: > Maybe someone should write one and open source it this time.. :) In presence of LLVM in the base, it looks, that we should generate native code from IPFW bytecodes, without intermediate C code :) Looks doeable! -- // Black Lion AKA Lev

Re: Firewall Profiling.

2011-12-27 Thread Juli Mallett
2011/12/27 Lev Serebryakov : > Hello, Luigi. > You wrote 27 декабря 2011 г., 18:26:00: > >> plans, yes - not sure how long it will take. I have compiled >> ipfw+dummynet as a standalone module (outside the kernel) >> but have not yet hooked the code to netmap to figure out how fast >> it can run. >

Re: i386 compile sys/dev/ie

2011-12-27 Thread Bruce Evans
On Wed, 28 Dec 2011, Bruce Evans wrote: On Wed, 28 Dec 2011, Sergey Kandaurov wrote: These were used in probe routine and are left from the newbus rewrite. I hacked ie a bit to build cleanly. [Not sure if I did this correctly.] Use of the __DEVOLATILE() abomination is never correct. It exp

Re: Firewall Profiling.

2011-12-27 Thread Adrian Chadd
On 27 December 2011 22:32, Juli Mallett wrote: > Reloading of mbufs into DMA descriptors?  mbuf allocator overhead > itself?  Interrupts.  Context switches under constant heavy load. > Some indirection in the network stack. Keeping caches primed? Not doing lots of very-deep-stack stuff for each

Re: i386 compile sys/dev/ie

2011-12-27 Thread Bruce Evans
On Wed, 28 Dec 2011, Sergey Kandaurov wrote: On 27 December 2011 23:45, Sean Bruno wrote: Doing a lot of compiles recently and keep noting this noise in sys/dev/ie: /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/if_ie.c: In function 'ieget': /dumpster/scratch/sbruno-scratch/head/sys/dev/ie/