Re: iptables performance under 2.6.0[-test9]

[Patrick McHardy <kaber@trash.net>]

Can you please provide (pcap format) packet dumps of

a) the correct situation
b) broken situation

I would like to have a look at it. Please make sure to capture
with "-s 1500" so the packets are in the dump completly.

Thanks,
Patrick

Andy Polyakov wrote:

>>I tried to deploy 2.6.0[-test9] iptables to masquerade a private
>>interace. Strangely enough ip_conntrack.ko module seems to affect
>>performance of *some* TCP connections. ... I'm looking for
>>triggering factors...
>>    
>>
>
>Apparently it's not certain connections as wholes which are affected,
>but only some outgoing packets. Those packets corresponding to socket
>writes larger than MTU-40 [where 40 is size of TCP/IP header]... I fail
>to imagine how come, but here is how I can reproduce the problem with
>attached head.pl script:
>
>- 'lsmod' to make sure *no* iptables modules are loaded;
>- 'time ./head.pl some.host 2000' says that it takes a portion of
>elapsed second for script to complete;
>- modprobe ip_conntrack;
>- 'time ./head.pl some.host 2000' now says that it takes over 3(!)
>elapsed seconds to complete;
>
>If I reduce amount of \n's send in first socket write by passing value
>of 1460 or lower as the last command-line argument, the script completes
>instantly regardless if ip_conntrack is loaded or not. Therefore the
>conclusion about MTU-40... Cheers. A.
>