From owner-freebsd-net@FreeBSD.ORG  Wed Sep 18 14:19:39 2013
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTP id 4E018562
 for <freebsd-net@freebsd.org>; Wed, 18 Sep 2013 14:19:39 +0000 (UTC)
 (envelope-from smithi@nimnet.asn.au)
Received: from sola.nimnet.asn.au (paqi.nimnet.asn.au [115.70.110.159])
 (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id B578C2D44
 for <freebsd-net@freebsd.org>; Wed, 18 Sep 2013 14:19:38 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by sola.nimnet.asn.au (8.14.2/8.14.2) with ESMTP id r8IEJXWB051679;
 Thu, 19 Sep 2013 00:19:34 +1000 (EST)
 (envelope-from smithi@nimnet.asn.au)
Date: Thu, 19 Sep 2013 00:19:33 +1000 (EST)
From: Ian Smith <smithi@nimnet.asn.au>
To: Luigi Rizzo <rizzo@iet.unipi.it>
Subject: Re: impact of disabling firewall on performance?
In-Reply-To: <CA+hQ2+h-2eEDHwAgBeO04yWn4SvcspOfujrZ1qBVPiN8syP90A@mail.gmail.com>
Message-ID: <20130918235331.R1460@sola.nimnet.asn.au>
References: <CAARSjE07M92tFmQkXPbN4_5b_eXseiYekZHkL=0b6UOK-qtixA@mail.gmail.com>
 <20130918175406.B1460@sola.nimnet.asn.au>
 <CA+hQ2+h-2eEDHwAgBeO04yWn4SvcspOfujrZ1qBVPiN8syP90A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: h bagade <bagadeh@gmail.com>,
 "freebsd-net@freebsd.org" <freebsd-net@freebsd.org>
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
 <mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 18 Sep 2013 14:19:39 -0000

On Wed, 18 Sep 2013 11:18:38 +0200, Luigi Rizzo wrote:
 > On Wed, Sep 18, 2013 at 10:07 AM, Ian Smith <smithi@nimnet.asn.au> wrote:
 > 
 > > On Wed, 18 Sep 2013 12:00:30 +0430, h bagade wrote:
 > >  > Hi all,
 > >  >
 > >  > I've heard that disabling firewall with commands or setting related
 > > sysctl
 > >  > parameter wouldn't increase performance and still firewalls participate
 > > in
 > >  > forwarding process. The only way to reach a better performance is making
 > >  > firewall modules to being loaded dynamically and thereafter unloading
 > >  > firewall modules!
 > >
 > > Where exactly did you hear that?
 > >
 > >  > I want to know is it right? and if so, why it should be like this?
 > >
 > > The difference between not invoking a firewall at all and invoking one
 > > with a single 'pass all' rule would be fairly difficult to measure per
 > > packet.  If your firewall is a bottleneck you likely have larger issues.
 > >
 > 
 > well...

:-) I almost added "though Luigi will have measured it to the ns/MHz"

 > unloading or disabling the firewall with a sysctl is likely
 > exactly the same in terms of performance -- it's just
 > something like
 > 
 >     if (firewall_loaded || firewall_enabled) {
 >          invoke_firewall(...);
 >     }

Not && ?

Either way, unloading the module/s couldn't gain any performance.

 > However, executing the firewall with a single pass rule consumes
 > some significant amount of time, see
 > http://info.iet.unipi.it/~luigi/papers/20091201-dummynet.pdf
 > (those numbers are from 2009 and i measured about 400ns;
 > recent measurements with ipfw-over-netmap on a fast i7
 > give about 100ns per packet).
 > 
 > This is definitely measurable.

Thanks for the spanking, and a second browsing of Dummynet Revisited.

cheers, Ian