On Sun, 2004-06-13 at 11:26, Antony Stone wrote: > On Sunday 13 June 2004 12:30 pm, lartc@xxxxxx wrote: > > > Hello > > > > Can someone tell me just how intensive netfilter is towards CPU? > > > > Is it posible for 6000 rules with no target set in the FORWARD chain to > > eat up about 60% of my P4 2.4 GHz? > > I would be very surprised at this, however you haven't said what sort of > bandwidth you're shovelling through the machine, and this will clearly make a > difference to the CPU usage. > > Also, when you say "6000 rules with no target set", I assume this means that > each packet is traversing all 6000 rules (presumably for some sort of > accounting process), and then getting to the bottom of the table and doing > something more interesting... > > One simple way of identifying whether it's the 6000 rules which are consuming > 60% of your CPU would be to temporarily reduce the ruleset to 2000 or 3000 > and see if you get a noticeable reduction in CPU usage (I wouldn't expect it > to be proportional, so don't look for 20% or 30%, but if it doesn't go down > by much, you know it's not the 6000 rules causing the load). > > How memory is in the machine? > > Are you using connection tracking (if so, how many connections are in > /proc/net./ip_conntrack)? > > Regards, > > Antony. How are you loading the rules? Is this high CPU utilization during the load sequence or are you certain the rules have already loaded and you still have such high CPU utilization? One should use the iptables-restore method of loading when using so many rules. Doing 6000 iptables commands will put a terrible load on the system and take forever to load - John -- John A. Sullivan III Chief Technology Officer Nexus Management +1 207-985-7880 john.sullivan@xxxxxxxxxxxxx --- If you are interested in helping to develop a GPL enterprise class VPN/Firewall/Security device management console, please visit http://iscs.sourceforge.net
