Hi, we have 2 8core Xeon Boxes with 2 Intel X520 10GBit Adapter running rhel 6.1 as redundant firewall. On every node we have conntrackd installed with a FTFW mode, we synchronize all states. Synchronization is made over multicast on a dedicated vlan interface. The Firewall itself actually have around 300 vlans active. Actually we see permanent ~400 new connections/sec with peaks at 800 conn/sec. With this load the conntrackd consumes about 15 - 25 % CPU from one CPU on the active side and about 5% CPU usage on the passive side. Is this expected ? This is our Testing environment, and we expect much higher (~10 - 20 times) connection rates. This would not be possible with the current setup, as this would be cpu bound on the conntrackd, as this daemon is single threaded. Is there any way to make this process faster, eg. make the synchronization multi threaded ? I already did some perf analysis, but they didnt gave us much light. Any ideas, hints welcome Greetings -- Stefan Majer -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
