On Monday 10 March 2003 09:41, Rinse Kloek wrote:
> We use a RedHat 7.3 machine as bridge on a P3 1.8 Ghz with 2 64 bits
> Gigabit interfaces. On the machine we have a lot of iptables rules like :
> all -- 213.134.225.0 0.0.0.0/0
> all -- 0.0.0.0/0 213.134.225.0
> TOS all -- 213.134.225.4 0.0.0.0/0 TOS set 0x08
> all -- 0.0.0.0/0 213.134.225.4
>
> Currently in the peak hours we have about 40 Megabit traffic. Also in this
> peak hours we have a CPU load of about 70%. What is the main reason of this
> CPU load, is it the high traffic or the iptables rules on the machine. And
> if the iptables rules are the reaseon of the high CPU load, does TOS
> mangling use much CPU?
I'm not sure, but I think the high traffic is the problem. And for iptables,
I thinkg changing something (TOS or DNAT/SNAT) is the most CPU intensive.
Maybe you can try to rearrange the iptables rules so the most matched rules
are in the beginning of your firewall script.
Maybe you can create a test setup so you can generate 40 Megabit traffic on a
test bridge without iptables rules to see what the CPU does.
Stef
--
stef.coene@xxxxxxxxx
"Using Linux as bandwidth manager"
http://www.docum.org/
#lartc @ irc.oftc.net
