Re: TCP/UDP checksum in hardware

[Patrick McHardy <kaber@trash.net>]

Alexander Sirotkin wrote:
> On 3/5/07, Patrick McHardy <kaber@trash.net> wrote:
> 
>> > BTW, while we are on the subject, the overhead of netfilter itself,
>> > i.e. the difference in CPU utilization of kernel with and without
>> > netfilter on the above platform is more than 5%. Is there anybody hear
>> > willing to discuss this ?
>>
>> Is this with netfilter modules (like iptables, conntrack, NAT, ...)
>> loaded or just by enabling netfilter in the configuration?
>>
> Just netfilter, no modules.
> Strangely enough, this only happens with bridge configuration. With
> router configuration the difference in CPU utilization is minor,
> however with bridge it is huge - about 25% on my system.


The bridge-netfilter code includes a number of hooks of its own,
additionally it passes all packets though all IP netfilter hooks
and duplicates quite a bit of the IP layer handling. I'm not very
surprised that its efficiency sucks, although 25% really is a lot.
If you could get profiles we could see if there are possibly some
simple optimizations.

If you don't need IP netfilter on bridged packets you could also
simply disable it through /proc/sys/net/bridge/bridge-nf-call-*.