Re: High interrupt load on firewalls

2002-10-18 Thread David Miller
On Wed, 9 Oct 2002, Attila Nagy wrote: With a dc ethernet card and ~45K packets per second, an XP1700 system went from 50% interrupt to 1%. I was astounded at the change! If all it takes to get Gb interfaces polling is to send Luigi a card then he needs to send me his shipping address:) ---

Re: High interrupt load on firewalls

2002-10-18 Thread David Miller
On Fri, 18 Oct 2002, Luigi Rizzo wrote: On Fri, Oct 18, 2002 at 12:59:27PM -0400, David Miller wrote: On Wed, 9 Oct 2002, Attila Nagy wrote: With a dc ethernet card and ~45K packets per second, an XP1700 system went from 50% interrupt to 1%. I was astounded at the change! that

[PATCH: if_ti] Re: High interrupt load on firewalls

2002-10-11 Thread Terry Lambert
Mike Silbersack wrote: On Wed, 9 Oct 2002, Christopher Smith wrote: The rule processing can't be done on the other CPU, can it ? Am I right in saying that at this point in time, buying a dual CPU (vs single CPU) machine for firewalling with FreeBSD is just a waste of money ? Even if it

Re: High interrupt load on firewalls

2002-10-09 Thread Attila Nagy
Hello, You might want to try out some of the Intel gigabit boards. At least we've got an engineer from Intel who maintains the driver. I'm far from being a FreeBSD expert, but Luigi Rizzo's polling patch helped me a lot in similar cases to get better performance. From POLLING(4): DESCRIPTION

Re: High interrupt load on firewalls

2002-10-09 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: No, we use IPFilter (and that definitely isn't going to change any time soon). Oh. Hm, maybe IPFilter 4.0 will be faster. looks around for darren What you might consider doing is profiling the kernel on your test system to see where the

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the specific case, at least reading

Re: High interrupt load on firewalls

2002-10-09 Thread Lars Eggert
Luigi Rizzo wrote: than move to a different board, or use polling (i have polling patches for the intel gigabit adapter) If you mean em(4) - I'd love to test them :-) Lars -- Lars Eggert [EMAIL PROTECTED] USC Information Sciences Institute smime.p7s Description: S/MIME

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 9/10/2002 6:20 PM, Attila Nagy [EMAIL PROTECTED] wrote: Hello, [chomp] and sys/kern/kern_poll.c: [...] #ifdef SMP #include opt_lint.h #ifndef COMPILING_LINT #error DEVICE_POLLING is not compatible with SMP #endif #endif [...] (no SMP support) This I can live with, as it

Re: High interrupt load on firewalls

2002-10-09 Thread Andre Oppermann
Luigi Rizzo wrote: my general attitude is that when you are hitting 100% cpu utilization, small performance improvements such as those deriving from m_getcl() are not relevant, and you might want to restructure your sw in order to get substantial performance improvements. In the

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 9:26 AM, Andre Oppermann [EMAIL PROTECTED] wrote: [chomp] He probably can't tell because of the 32bit ifstats counters. They wrap every other minute on a well loaded Gigabit card. A 'systat -ip 1' shows rates ranging from 120kpps to 250kpps, averaging around the 150 - 180 range.

Re: High interrupt load on firewalls

2002-10-09 Thread Christopher Smith
On 10/10/02 10:00 AM, Luigi Rizzo [EMAIL PROTECTED] wrote: On Thu, Oct 10, 2002 at 09:38:40AM +1000, Christopher Smith wrote: ... With the 2.4GHz 2650 we have currently, er, borrowed to do some testing with, the load is down to 35% or so (highest I've seen it is 40%) and the packet loss is

Re: High interrupt load on firewalls

2002-10-09 Thread Luigi Rizzo
On Thu, Oct 10, 2002 at 11:18:42AM +1000, Christopher Smith wrote: ... Ok, so any of the network benching products that can spit out a stream of UDP traffic should suffice ? i presume so, yes. I have some tweaks in the kernel to duplicate packets in the kernel and get higher peak rates, but

Re: High interrupt load on firewalls

2002-10-08 Thread Mike Silbersack
On Wed, 9 Oct 2002, Christopher Smith wrote: We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 (ti driver) fibre cards with about 7 vlans spread across them. Both these machines run at *very* high interrupt loads (95 - 100% during business hours (mostly 100%), 80 -

Re: High interrupt load on firewalls

2002-10-08 Thread Christopher Smith
On 9/10/02 3:07 PM, Mike Silbersack [EMAIL PROTECTED] wrote: On Wed, 9 Oct 2002, Christopher Smith wrote: We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 (ti driver) fibre cards with about 7 vlans spread across them. Both these machines run at *very* high

Re: High interrupt load on firewalls

2002-10-08 Thread Julian Elischer
On Wed, 9 Oct 2002, Christopher Smith wrote: On 9/10/02 3:07 PM, Mike Silbersack [EMAIL PROTECTED] wrote: On Wed, 9 Oct 2002, Christopher Smith wrote: We have two firewalls sitting on gigabit links. Each has 2 Netgear GA620 (ti driver) fibre cards with about 7 vlans spread