Re: Conntrack Events Performance - Multipart Messages?

[Patrick McHardy <kaber@trash.net>]

Fabian Hugelshofer wrote:
> Hi,
> 
> I am writing a network application for a genuine wireless router (266Mhz 
> IXP4XX). I am capturing packets with ULOG and need connection tracking. 
> For performance reasons I planned to use connection tracking events 
> (NEW/DESTROY) to avoid doing the same work twice.
> 
> In a high load test case I stress the router with UDP packets with 
> random source ports (1000B payload, 1800pps). CPU usage is 100%, 10% of 
> packets and 80% ctevents are dropped. If I disable ctevents, the CPU 
> usage is just 24% and no packet drops occur.
> 
> My application is not very heavy and I expect most of the ctevent 
> overhead to be caused by passing events from kernel to user space. I 
> expect that performance could be increased by using multipart messages 
> for ctevents like it is done in ULOG/NFLOG.
> 
> Do you share my opinion, that multipart messages would lead to 
> significant performance improvements? (Actually, I doubt that I will be 
> more efficient than performing connection tracking in user space)

Quite possible, but some profiles would be useful to determine
whether this is actually the bottleneck.

> Do you think introducing multipart messages for connection tracking 
> events is feasible without breaking existing applications? Maybe with a 
> default setting of 1 bundled events, which can be increased by a 
> function call?

That sounds sane.

> Is someone intending to implement multipart messages for ctevents? ;-)

I don't think so.