Re: [pfSense] Traffic Graph: Not reflecting reality?

2013-11-07 Thread Chris Bagnall
We recently relocated and are waiting to get our primary connection installed, so in the mean time we're on a 3Mb/0.75Mb DSL line. However, pfSense often shows 6Mb/s coming out of the LAN during a download. Same problem here. I am not seeing incorrect traffic graphs in 2.1, and I am using

Re: [pfSense] Motherboard compatibility

2013-11-07 Thread Vick Khera
On Wed, Nov 6, 2013 at 9:24 AM, Paul Mather p...@gromit.dlib.vt.edu wrote: If those figures that the hardware producer provided are correct, it would mean that I could run pfSense 2.1 only on the C204 board, since pfSense 2.1 is based on FreeBSD 8.3, and the C222 board is only compatible

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Vick Khera
On Wed, Nov 6, 2013 at 8:29 AM, Jim Thompson j...@netgate.com wrote: There are reports that FreeBSD doesn't support AES-NI very well. I'm thinking it is either zero gain, or negative gain. On pfSense 2.1-RELEASE (aka FreeBSD 8.3 with OpenSSL 1.0.1e) we see: % /usr/local/bin/openssl speed

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Vick Khera
On Wed, Nov 6, 2013 at 11:04 AM, Thinker Rix thinke...@rocketmail.comwrote: What do you think is the reason for your VPN traffic maxing out at 20Mpbs (I assume that your connection is not the traffic bottle neck, right?), although your CPUs are almost idle? I'm fairly sure it is the office

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Vick Khera
On Thu, Nov 7, 2013 at 9:44 AM, Vick Khera vi...@khera.org wrote: CLEARLY it is killer fast for larger blocks. I just pondered this for a few minutes... I think openssl's summary numbers are misleading. They give you the time per CPU seconds used. So while the CPU is not doing the

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Jim Pingle
On 11/7/2013 8:51 AM, Vick Khera wrote: On Wed, Nov 6, 2013 at 8:29 AM, Jim Thompson j...@netgate.com mailto:j...@netgate.com wrote: There are reports that FreeBSD doesn't support AES-NI very well. I'm thinking it is either zero gain, or negative gain. On pfSense 2.1-RELEASE (aka

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Vick Khera
On Thu, Nov 7, 2013 at 9:54 AM, Jim Pingle li...@pingle.org wrote: Also see the How To Test tab and other data here: https://docs.google.com/spreadsheet/ccc?key=0AojFUXcbH0ROdE15eHB4dndHTXZYcU1mQm9Dc3V2elEusp=sharing The sheet could really use some more data, so anyone who has an AES-NI

Re: [pfSense] Motherboard compatibility

2013-11-07 Thread Thinker Rix
Hi Vick, On 2013-11-07 15:40, Vick Khera wrote: On Wed, Nov 6, 2013 at 9:24 AM, Paul Mather p...@gromit.dlib.vt.edu mailto:p...@gromit.dlib.vt.edu wrote: If those figures that the hardware producer provided are correct, it would mean that I could run pfSense 2.1 only on the

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Vick Khera
On Thu, Nov 7, 2013 at 9:54 AM, Jim Pingle li...@pingle.org wrote: The sheet could really use some more data, so anyone who has an AES-NI capable system, feel free to run through the tests and help fill out the sheet. :-) /usr/bin/openssl speed -evp aes-128-cbc -elapsed The 'numbers' are in

Re: [pfSense] Motherboard compatibility

2013-11-07 Thread compdoc
So if I understand you right, even if I use pfSense 2.1 (FreeBSD 8.3) on a motherboard with a brand new chipset (Intel C222) and CPU (e.g. Core i3 / Haswell) it should work, eventhough FreeBSD 8.3 is older than those technologies and might not fully support the chipset yet (e.g. due to

Re: [pfSense] Motherboard compatibility

2013-11-07 Thread Vick Khera
On Thu, Nov 7, 2013 at 10:05 AM, Thinker Rix thinke...@rocketmail.comwrote: So if I understand you right, even if I use pfSense 2.1 (FreeBSD 8.3) on a motherboard with a brand new chipset (Intel C222) and CPU (e.g. Core i3 / Haswell) it should work, eventhough FreeBSD 8.3 is older than those

Re: [pfSense] AES-NI support of the CPU: Does it make sense for VPN with pfSense?

2013-11-07 Thread Jim Pingle
On 11/7/2013 10:30 AM, Vick Khera wrote: On Thu, Nov 7, 2013 at 9:54 AM, Jim Pingle li...@pingle.org mailto:li...@pingle.org wrote: The sheet could really use some more data, so anyone who has an AES-NI capable system, feel free to run through the tests and help fill out the

Re: [pfSense] Traffic Graph: Not reflecting reality?

2013-11-07 Thread Mike McLaughlin
So I realized that I am capturing the traffic via SNMP so I looked -- it shows the same ~200% use on my DMZ vs the WAN it's using. I was a bit surprised by this because the pfSense RRD graphs do not appear to have the same discrepancy - they show nearly mirror images for the 2 interfaces. Mike

Re: [pfSense] Hardware requirements for gigabit wirespead

2013-11-07 Thread Michael Schuh
Hi there, 2013/11/7 Thinker Rix thinke...@rocketmail.com Hi Michael, On 2013-11-06 11:37, Michael Schuh wrote: i have serval different Systems running, including an old 3GHz Intel Pentium D-CPU with 2GBytes ECC Memory: 4 Nic, throughput max (so far): 115 MBytes/s at 20k irqs (no polling