Hi; First, sorry if this question is mostly netfilter related, than lartc, but I think you guys may have a your opinion about this. I'm using Linux 2.4.x with netfilter packet filtering / NAT on our front-end firewalls (P500 with 1Gb RAM), which are filtering traffic going to our Public Web Sites. The traffic is growing very fast since several months.. The average traffic filtered by our firewalls, is around 30/40 Mbits/s, with peaks around 70 Mbits/s sometimes, so that we had to switch to gigabit technologies, to keep a good safe margin. Our firewalls are not so high speed machines (P500 with 1Gb RAM), but are doing good so far. It seems, however, that we are reaching the limits, when approaching 70 Mb/s... cpu utilization is then near 100%, and the machines start dropping packets. So, my question is, is netfilter able to handle, let's say gigabit traffic filtering ? What kind of hardware would be necessary to handle such traffic ? Have you guys any experience with filtering such high speed traffic ? I also thought of two possible solutions, to optimize our current firewalls, on which you may have an opinion. 1) Disabling statefull inspection, by unloading connection tracking modules. I believe netfilter without connection tracking, might be much more efficient (We don't need connection tracking actually, since we are only filtering HTTP traffic from the others traffics at this point) 2) Replace iptables by nf-hipac for packet filtering. Have you guys any experience with nf-hipac ? (http://www.hipac.org/) I would be really thanksfull to hear of any solutions / workarounds / optimization to keep our linux firewalls handling growing traffic :-) Thanks ! Vincent. --- Vincent Jaussaud Kelkoo.com Security Manager email: tatooin@xxxxxxxxxx "Those who desire to give up freedom in order to gain security will not have, nor do they deserve, either one." -- President Thomas Jefferson. 1743-1826 _______________________________________________ LARTC mailing list / LARTC@xxxxxxxxxxxxxxx http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
