Re: High interrupt load on firewalls

2002-10-09 Thread Attila Nagy
Hello, You might want to try out some of the Intel gigabit boards. At least we've got an engineer from Intel who maintains the driver. I'm far from being a FreeBSD expert, but Luigi Rizzo's polling patch helped me a lot in similar cases to get better performance. From POLLING(4): DESCRIPTION

Re: High interrupt load on firewalls

2002-10-09 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: No, we use IPFilter (and that definitely isn't going to change any time soon). Oh. Hm, maybe IPFilter 4.0 will be faster. looks around for darren What you might consider doing is profiling the kernel on your test system to see where the

VPN Tunneling

2002-10-09 Thread Ivailo Tanusheff
Hello, I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K Machine. My configuration is: {Net1} --- FreeBSD --...-- Win2K --- {Net2} Win2k machine has dynamically assigned IP address as it's connecting to public ISP. Can you help me build the tunnel? Regards, Ivailo

Re: VPN Tunneling

2002-10-09 Thread Peter Pentchev
On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: Hello, I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K Machine. My configuration is: {Net1} --- FreeBSD --...-- Win2K --- {Net2} Win2k machine has dynamically assigned IP address as it's connecting

Re: Sympatico ADSL connection through a hub

2002-10-09 Thread Damian Gerow
For archival purposes... He has a DLink router, which was handling the PPPoE itself, and using DHCP for the LAN behind it. We took out the PPP configuration, put in DHCP (ifconfig_dc0=DHCP), and it's all up and running. - Damian To Unsubscribe: send mail to [EMAIL PROTECTED] with

How to get hardware address of a machine using ARP/Sysctl/Routing sockets??

2002-10-09 Thread yatin chalke
Hi, I want to get hardware address of any machine on a subnet using sysctl and routing sockets. I can search arp cache and return the hardware address if it is there. But if the hardware address is not in ARP cache then I cant retrieve it. Is there any way to get hardware address of any

Re: VPN Tunneling

2002-10-09 Thread Andy
On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: Hello, I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K Machine. My configuration is: {Net1} --- FreeBSD --...-- Win2K --- {Net2} Win2k machine has dynamically assigned IP address as it's connecting to

Re: VPN Tunneling

2002-10-09 Thread Peter Pentchev
On Wed, Oct 09, 2002 at 08:37:30AM -0600, Andy wrote: On Wed, Oct 09, 2002 at 01:49:51PM +0300, Ivailo Tanusheff wrote: Hello, I'm trying to make a VPN tunnel between a FreeBSD machine and a Win2K Machine. My configuration is: {Net1} --- FreeBSD --...-- Win2K --- {Net2} Win2k

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the specific case, at least reading

Re: How to get hardware address of a machine using ARP/Sysctl/Routingsockets??

2002-10-09 Thread Lars Eggert
yatin chalke wrote: I want to get hardware address of any machine on a subnet using sysctl and routing sockets. I can search arp cache and return the hardware address if it is there. I'm not 100% sure I understand what you want to do, but using nmap (or similar) to scan the subnet should

Re: High interrupt load on firewalls

2002-10-09 Thread Lars Eggert
Luigi Rizzo wrote: than move to a different board, or use polling (i have polling patches for the intel gigabit adapter) If you mean em(4) - I'd love to test them :-) Lars -- Lars Eggert [EMAIL PROTECTED] USC Information Sciences Institute smime.p7s Description: S/MIME

Re: Q about sbin/ip6fw/ip6fw.c:list()

2002-10-09 Thread Luigi Rizzo
On Mon, Oct 07, 2002 at 11:29:50PM +0300, Andrey Simonenko wrote: Hello, Why is it not allowed to get more that 65536 ip6fw rules from the kernel in the ip6fw.c:list() function? i think it is just an oversight -- perhaps the author though that each rule had to have its own number.

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 9/10/2002 6:20 PM, Attila Nagy [EMAIL PROTECTED] wrote: Hello, [chomp] and sys/kern/kern_poll.c: [...] #ifdef SMP #include opt_lint.h #ifndef COMPILING_LINT #error DEVICE_POLLING is not compatible with SMP #endif #endif [...] (no SMP support) This I can live with, as it

Re: High interrupt load on firewalls

2002-10-09 Thread Andre Oppermann
Luigi Rizzo wrote: my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 9:26 AM, Andre Oppermann [EMAIL PROTECTED] wrote: [chomp] He probably can't tell because of the 32bit ifstats counters. They wrap every other minute on a well loaded Gigabit card. A 'systat -ip 1' shows rates ranging from 120kpps to 250kpps, averaging around the 150 - 180 range.

in-kernel traffic generator?

2002-10-09 Thread Lars Eggert
Hi, anyone know of an in-kernel traffic generator similar to UDPgen (http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) for Linux? Userland traffic generators have high overheads with small packets at Gigabit speeds. (If not, netgraph should allow an easy

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 10:00 AM, Luigi Rizzo [EMAIL PROTECTED] wrote: On Thu, Oct 10, 2002 at 09:38:40AM +1000, Christopher Smith wrote: ... With the 2.4GHz 2650 we have currently, er, borrowed to do some testing with, the load is down to 35% or so (highest I've seen it is 40%) and the packet loss is

in-kernel traffic generator?

2002-10-09 Thread Garrett Wollman
On Wed, 09 Oct 2002 18:18:41 -0700, Lars Eggert [EMAIL PROTECTED] said: anyone know of an in-kernel traffic generator similar to UDPgen (http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) for Linux? Userland traffic generators have high overheads with

Re: in-kernel traffic generator?

2002-10-09 Thread Lars Eggert
Garrett Wollman wrote: On Wed, 09 Oct 2002 18:18:41 -0700, Lars Eggert [EMAIL PROTECTED] said: anyone know of an in-kernel traffic generator similar to UDPgen (http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) for Linux? Userland traffic generators have

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
On Thu, Oct 10, 2002 at 11:18:42AM +1000, Christopher Smith wrote: ... Ok, so any of the network benching products that can spit out a stream of UDP traffic should suffice ? i presume so, yes. I have some tweaks in the kernel to duplicate packets in the kernel and get higher peak rates, but

Re: in-kernel traffic generator?

2002-10-09 Thread Julian Elischer
On Wed, 9 Oct 2002, Lars Eggert wrote: Hi, anyone know of an in-kernel traffic generator similar to UDPgen (http://www.fokus.gmd.de/research/cc/glone/employees/sebastian.zander/private/udpgen/) for Linux? Userland traffic generators have high overheads with small packets at Gigabit

DAWG for IPFW2/IPF

2002-10-09 Thread Michael C. Wu
Hi Luigi and Darren, Regarding IPFW2 and IPF, do you have plans on implementing a DAWG algorithm for the pattern matching? (Directed Acyclic Word Graphs) http://citeseer.nj.nec.com/crochemore99fast.html It is a new algorithm that does super fast multiple stream/pattern matching in a

Re: DAWG for IPFW2/IPF

2002-10-09 Thread Luigi Rizzo
On Wed, Oct 09, 2002 at 07:47:30PM -0700, Michael C. Wu wrote: Hi Luigi and Darren, Regarding IPFW2 and IPF, do you have plans on implementing a DAWG algorithm for the pattern matching? (Directed Acyclic Word Graphs) my quick answer is no -- it might be interesting stuff, but have too