system:benches10gbps:firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
|
system:benches10gbps:firewall [2012/10/17 17:17] ze |
system:benches10gbps:firewall [2012/11/02 15:41] (current) ze ipset |
||
|---|---|---|---|
| Line 353: | Line 353: | ||
| Will have to seek for other solutions. | Will have to seek for other solutions. | ||
| + | |||
| + | ===== ipset ===== | ||
| + | |||
| + | Some people mentionned ipset. Lets bench that. | ||
| + | |||
| + | <code> | ||
| + | # lets create some sets we might use | ||
| + | ipset create ip hash:ip | ||
| + | ipset create net hash:net | ||
| + | ipset create ip,port hash:ip,port | ||
| + | ipset create net,port hash:net,port | ||
| + | </code> | ||
| + | |||
| + | Rules used for different tests : | ||
| + | <code> | ||
| + | -A FORWARD -m set --match-set ip src | ||
| + | -A FORWARD -m set --match-set net src | ||
| + | -A FORWARD -m set --match-set net,port src,src | ||
| + | -A FORWARD -m set --match-set ip,port src,dst | ||
| + | </code> | ||
| + | |||
| + | Lets see how a few match for hash:ip affects our traffic : | ||
| + | |||
| + | ^ # rules ^ conn/s ^ pkt/s ^ | ||
| + | | 1 | 570k | 3.6M | | ||
| + | | 2 | 340k | 2.05M | | ||
| + | | 3 | 240k | 1.45M | | ||
| + | | 4 | 184k | 1.1M | | ||
| + | |||
| + | Ok, so just a few ipset match affects us ALOT. What about other hashes ? | ||
| + | |||
| + | (tests done with 2 matches) | ||
| + | |||
| + | ^ ipset ^ conn/s ^ pkt/s ^ | ||
| + | | hash:ip | 340k | 2.05M | | ||
| + | | hash:net | 350k | 2.1M | | ||
| + | | hash:ip,port | 330k | 2M | | ||
| + | | hash:net,port | 330k | 2M | | ||
| + | |||
| + | Net or ip doesn't change much, and including the port is only a light overhead, | ||
| + | considering the overhead we already have. | ||
| + | |||
| + | What about ipset bitmasks ? | ||
| + | |||
| + | <code> | ||
| + | ipset create bip0 bitmap:ip range 10.136.0.0-10.136.255.255 | ||
| + | ipset create bip1 bitmap:ip range 10.140.0.0-10.140.255.255 | ||
| + | </code> | ||
| + | |||
| + | ^ # rules ^ conn/s ^ pkt/s ^ | ||
| + | | 2 | 550k | 3.5M | | ||
| + | | 4 | 320k | 1.9M | | ||
| + | |||
| + | |||
| + | Considering ipset is limited to 65k entries, and the results, I would advise | ||
| + | against using it, unless you really need the easy to manage set. | ||
| + | |||
| ===== interface irq affinity ===== | ===== interface irq affinity ===== | ||
system/benches10gbps/firewall.1350494269.txt.gz ยท Last modified: 2012/10/17 17:17 by ze
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Noncommercial-Share Alike 4.0 International
