Re: iptables/ipset caused packet drops on interfaces

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 14 Jul 2009, Vects wrote:

> On Tue, 2009-07-14 at 11:19 +0200, Jozsef Kadlecsik wrote:
> > On Tue, 14 Jul 2009, Vects wrote:
> > 
> > > I'm using iptables/ipsets on busy linux firewall, this firewall handles
> > > 300-400 Mb/s during the working hours, time to time I see significant
> > > traffic drop and ksoftirqd/1 uses 100% cpu, in this situation I do
> > > stop/start iptables, after that network traffic and ksoftirqd returned
> > > to be normal.
> > > First I thought this is a problem with network card driver, changing the
> > > driver didn't help, then I found that it depends from the number of
> > > ipsets in iptables. 
> > 
> > How did you verify that? What kind of sets do you use?
>
> I set up similar test environment, generated traffic by iperf, set up
> iptables/ipset rules with all accept, started to get drops, removed few
> rules until it got back to normal. 
> Another day I did the same sort of tests with some commercial traffic
> generator tool and got the same result.
> Mostly I'm using iphash ipsets with few nethash type, the biggest ipset
> has 4000 IPs
[...]
> net.ipv4.netfilter.ip_conntrack_max=14316556

You should tune the hashsize parameter of the nf_conntrack module and not 
the ip_conntrack_max sysctl parameter. Conntrack may spend most of the 
time traversing the long chains in the hashtable.

Best regards,
Jozsef
-
E-mail  : kadlec@xxxxxxxxxxxxxxxxx, kadlec@xxxxxxxxxxxx
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Netfilter Development]     [Linux Kernel Networking Development]     [Netem]     [Berkeley Packet Filter]     [Linux Kernel Development]     [Advanced Routing & Traffice Control]     [Bugtraq]

  Powered by Linux