Date: Tue, 27 Aug 2019 21:03:19 +0300 From: "Andrey V. Elsukov" <bu7cher@yandex.ru> To: Victor Gamov <vit@otcnet.ru>, Eugene Grosbein <eugen@grosbein.net>, freebsd-net@freebsd.org Subject: Re: finding optimal ipfw strategy Message-ID: <ddaa55bc-1fa5-151b-258e-e3e9844802ef@yandex.ru> In-Reply-To: <a559d2bd-5218-f344-2e88-c00893272222@otcnet.ru> References: <f38b21a5-8f9f-4f60-4b27-c810f78cdc88@otcnet.ru> <4ff39c8f-341c-5d72-1b26-6558c57bff8d@grosbein.net> <a559d2bd-5218-f344-2e88-c00893272222@otcnet.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--t4aIzluZvDmDHeKPHFtgv72lbWVPGkAP8
Content-Type: multipart/mixed; boundary="eLoN6jvRA70jdKvRzdV2b1T5l5r22FWpQ";
protected-headers="v1"
From: "Andrey V. Elsukov" <bu7cher@yandex.ru>
To: Victor Gamov <vit@otcnet.ru>, Eugene Grosbein <eugen@grosbein.net>,
freebsd-net@freebsd.org
Message-ID: <ddaa55bc-1fa5-151b-258e-e3e9844802ef@yandex.ru>
Subject: Re: finding optimal ipfw strategy
References: <f38b21a5-8f9f-4f60-4b27-c810f78cdc88@otcnet.ru>
<4ff39c8f-341c-5d72-1b26-6558c57bff8d@grosbein.net>
<a559d2bd-5218-f344-2e88-c00893272222@otcnet.ru>
In-Reply-To: <a559d2bd-5218-f344-2e88-c00893272222@otcnet.ru>
--eLoN6jvRA70jdKvRzdV2b1T5l5r22FWpQ
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable
On 26.08.2019 19:25, Victor Gamov wrote:
> More general question about my current config.=C2=A0 I have about 200Mb=
it
> input multicasts which bridged and filtered later (about 380 Mbit
> bridged if trafshow does not lie me :-) )
>=20
> My FreeBSD box (12.0-STABLE r348449 GENERIC=C2=A0 amd64)=C2=A0 has one =
"Intel(R)
> Xeon(R) CPU E31270 @ 3.40GHz"=C2=A0 and 4-ports=C2=A0 "Intel(R) PRO/100=
0
> PCI-Express Network Driver".=C2=A0 HT disabled and traffic mainly incom=
e via
> igb0 and out both via igb0 and igb2.=C2=A0 About 30 VLANs now active so=
me at
> igb0 and some at igb2.
>=20
>=20
> And I have following `top` stat:
> =3D=3D=3D=3D=3D
> CPU 0:=C2=A0 0.0% user,=C2=A0 0.0% nice, 80.5% system,=C2=A0 0.0% inter=
rupt, 19.5% idle
> CPU 1:=C2=A0 0.0% user,=C2=A0 0.0% nice, 34.1% system,=C2=A0 0.0% inter=
rupt, 65.9% idle
> CPU 2:=C2=A0 0.0% user,=C2=A0 0.0% nice, 17.1% system,=C2=A0 0.0% inter=
rupt, 82.9% idle
> CPU 3:=C2=A0 0.0% user,=C2=A0 0.0% nice, 46.3% system,=C2=A0 0.0% inter=
rupt, 53.7% idle
> =3D=3D=3D=3D=3D
This doesn't look like heavy ipfw load.
E.g. this is top output from slightly loaded firewall (300Mbytes/s
~500kpps):
last pid: 58184; load averages: 9.07, 8.98, 8.83
up
72+07:45:55 21:01:36
821 processes: 36 running, 680 sleeping, 105 waiting
CPU 0: 0.0% user, 0.0% nice, 0.0% system, 28.1% interrupt, 71.9% idle=
CPU 1: 0.0% user, 0.0% nice, 0.0% system, 33.6% interrupt, 66.4% idle=
CPU 2: 0.0% user, 0.0% nice, 0.0% system, 28.9% interrupt, 71.1% idle=
CPU 3: 0.0% user, 0.0% nice, 0.0% system, 27.3% interrupt, 72.7% idle=
CPU 4: 0.0% user, 0.0% nice, 0.0% system, 21.1% interrupt, 78.9% idle=
CPU 5: 0.0% user, 0.0% nice, 0.0% system, 26.6% interrupt, 73.4% idle=
CPU 6: 0.0% user, 0.0% nice, 0.0% system, 28.1% interrupt, 71.9% idle=
CPU 7: 0.0% user, 0.0% nice, 0.0% system, 21.1% interrupt, 78.9% idle=
CPU 8: 0.0% user, 0.0% nice, 0.0% system, 35.2% interrupt, 64.8% idle=
CPU 9: 0.0% user, 0.0% nice, 0.0% system, 29.7% interrupt, 70.3% idle=
CPU 10: 0.0% user, 0.0% nice, 0.0% system, 27.3% interrupt, 72.7% idle=
CPU 11: 0.0% user, 0.0% nice, 0.0% system, 19.5% interrupt, 80.5% idle=
CPU 12: 0.0% user, 0.0% nice, 0.0% system, 32.8% interrupt, 67.2% idle=
CPU 13: 0.0% user, 0.0% nice, 0.0% system, 34.4% interrupt, 65.6% idle=
CPU 14: 0.0% user, 0.0% nice, 0.0% system, 29.7% interrupt, 70.3% idle=
CPU 15: 0.0% user, 0.0% nice, 0.0% system, 26.6% interrupt, 73.4% idle=
CPU 16: 0.0% user, 0.0% nice, 0.0% system, 28.9% interrupt, 71.1% idle=
CPU 17: 0.0% user, 0.0% nice, 0.0% system, 34.4% interrupt, 65.6% idle=
CPU 18: 0.0% user, 0.0% nice, 0.0% system, 36.7% interrupt, 63.3% idle=
CPU 19: 0.0% user, 0.0% nice, 0.0% system, 21.9% interrupt, 78.1% idle=
CPU 20: 0.0% user, 0.0% nice, 0.0% system, 21.1% interrupt, 78.9% idle=
CPU 21: 0.0% user, 0.0% nice, 0.0% system, 32.0% interrupt, 68.0% idle=
CPU 22: 0.0% user, 0.0% nice, 0.0% system, 33.6% interrupt, 66.4% idle=
CPU 23: 0.0% user, 0.0% nice, 0.0% system, 26.6% interrupt, 73.4% idle=
CPU 24: 0.0% user, 0.0% nice, 0.0% system, 21.9% interrupt, 78.1% idle=
CPU 25: 0.0% user, 0.0% nice, 0.0% system, 21.1% interrupt, 78.9% idle=
CPU 26: 0.0% user, 0.0% nice, 0.0% system, 0.0% interrupt, 100% idle=
CPU 27: 0.0% user, 0.0% nice, 0.0% system, 0.0% interrupt, 100% idle=
# pmcstat -S instructions -Tw1
PMC: [INSTR_RETIRED_ANY] Samples: 443074 (100.0%) , 0 unresolved
Key: q =3D> exiting...
%SAMP IMAGE FUNCTION CALLERS
39.2 kernel sched_idletd fork_exit
10.9 ipfw.ko ipfw_chk ipfw_check_packet
3.6 kernel cpu_search_lowest cpu_search_lowest
2.8 kernel lock_delay _mtx_lock_spin_cookie
2.5 kernel _rm_rlock in6_localip:1.3 pfil_run_hooks:0.6
2.2 kernel rn_match ta_lookup_radix:1.5
fib6_lookup_nh_basic:0.6
As you can see, when ipfw produces high load, interrupt column is more
than system.
--=20
WBR, Andrey V. Elsukov
--eLoN6jvRA70jdKvRzdV2b1T5l5r22FWpQ--
--t4aIzluZvDmDHeKPHFtgv72lbWVPGkAP8
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQEzBAEBCAAdFiEE5lkeG0HaFRbwybwAAcXqBBDIoXoFAl1lcGcACgkQAcXqBBDI
oXqHjAf/WcebHfqWh98HZQGOWchcfjl321Gvvw9+kJ9HCIB201ZQ7xzEXIDl8IST
5W8lMAHh4UkYqyd/Om9thL4T5lQCDO9jAw/B8A4VmQuheMY5dVvO2mGd2mk6+gH/
7QHVVK/BU9r5tiX8oCXFEGBs6T3cZPT7HaWF4BLuFV0B0VRF7V9fH/XxgkLRzsLm
nTVvAXjRekHuK5CXOI8kJBgwV0hA83GwnRGdwZaL33q/vQpWJRK6D1xHZ3477lg3
hykidpvwoQw1bJhR0LWtAAZ0CaDjv2SLCplDsG89ZmREsImWZmgU9DC1RiPdSgKb
Bnv4joEkFEYXz8k87einnE2xHCsdbg==
=GzyU
-----END PGP SIGNATURE-----
--t4aIzluZvDmDHeKPHFtgv72lbWVPGkAP8--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?ddaa55bc-1fa5-151b-258e-e3e9844802ef>