Re: TCP/UDP checksum in hardware

[Patrick McHardy <kaber@trash.net>]

Alexander Sirotkin wrote:
> On 3/4/07, Patrick McHardy <kaber@trash.net> wrote:
> 
>> Alexander Sirotkin wrote:
>> > The reason I'm asking is that computing checksum (in case of NAT, for
>> > instance) becomes a real problem on embedded devices
>>
>> Do you have any data to show this?
>>
> I don't know how relevant this is for netfilter, but yes - if the
> device does not support checksum offloading my benchmark which I ran
> on 266Mhz MIPS 24K (which is a pretty common processor for residential
> gateways) showed that under 80Mbps UDP traffic, with NAT enabled,
> checksum check takes about 15% CPU.

The first question would be whether this is really checksumming
done by netfilter or by the UDP code. Since enabling checksum
offloading seems to help, this points to the UDP code. In case
it is netfilter, the second question would be whether its
checksum verification or updates.

> BTW, while we are on the subject, the overhead of netfilter itself,
> i.e. the difference in CPU utilization of kernel with and without
> netfilter on the above platform is more than 5%. Is there anybody hear
> willing to discuss this ?

Is this with netfilter modules (like iptables, conntrack, NAT, ...)
loaded or just by enabling netfilter in the configuration?

BTW, which kernel version are you talking about?