Date: Tue, 9 Oct 2007 15:19:55 -0400 From: Michael Conlen <m@obmail.net> To: freebsd-pf@freebsd.org Subject: PF in FreeBSD 5.3 versus 6.x Message-ID: <DD7C3199-BA7A-4845-B03E-DC3D5A83F356@obmail.net>
next in thread | raw e-mail | index | archive | help
I've noticed at some point between 5.3 and 6.0 that PF seems to be dropping more packets than with 5.3 and there is increased deviation in latency. Using the same equipment handling about 25k PPS each way I see about 0.3% packet loss with FreeBSD 6.2 and 6.0 with sub 0.1% loss with FreeBSD 5.3. Similarly the worst case response times for ICMP packets is much less in 5.3 than in either version of 6. I'm using something pretty vanilla in terms of setup. No ALTQ support or features, no redirects, just a lot of blocking and allowing. The firewalls are using server class 3Com and Intel Gigabit (Fiber) cards. The changes were noticed going forward and undone by going back to FreeBSD 5.3 so I don't suspect physical problems at the moment. My pf.conf is essentially a block in all followed by a block in quick against a table with 2000 entries, many of the /24 or /16 followed by pass rules to the various host:ports we allow. If I login to the firewalls themselves and run mtr in each direction I don't see any traffic loss. It's only when crossing the firewalls. Usage is about 25k packets per second and 100Mbit/sec 5 minute max traffic. The switches are Foundry SI-800g. Also doing about 25k/sec searches with 400 inserts a second and 270 removals and 407 matches/sec. The state table seems to run about 70,000 to 90,000 Are there issues I should be aware of and should pf be able to handle this kind of load? -- Michael Conlen
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?DD7C3199-BA7A-4845-B03E-DC3D5A83F356>