From: Paul <xerox@foonet.net>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] iptables/cpu utilization
Date: Sat, 05 Jun 2004 00:12:09 +0000 [thread overview]
Message-ID: <1086394329.11341.30.camel@localhost.localdomain> (raw)
In-Reply-To: <1086390429.11341.24.camel@localhost.localdomain>
Suppose I forgot to say, this is with 2.6.6 kernel and a dual xeon 2.8..
I also noticed another major problem is that NOTHING is set up for SMP..
NO matter how many packets i'm routing or filtering it ALWAYS USES ONE
CPU and it's ALWAYS SOFTIRQ that uses all the CPU usage.. It's driving
me crazy.. there has to be a bug somewhere that's causing cpu usage,
either that or the software is SO poorly written that 100,000 packets
per second bring the whole box to it's knees.. it would be sad
and god no i'd never use conntrack.. even 10000 pps and conntrack dies a
horrible death.. what a nasty piece of code :)
On Fri, 2004-06-04 at 19:46, Kresimir Sparavec wrote:
> do you use connection tracking? if yes, then you could be in trouble,
> conntrack hashing doesn't perform well under load (with kernel 2.4)
>
>
> On Fri, Jun 04, 2004 at 07:07:09PM -0400, Paul wrote:
> > What in the WORLD is using so much CPU.. we are getting a denial of
> > service attack about 100,000 packets per second and the router is 100%
> > cpu, then when I do iptables -t mangle -I PREROUTING ..etc.. -j DROP to
> > match the packets and drop them the CPU drops to like 15% ... so my
> > question is
> > #1. What in the world uses all that cpu simple routing packets in one
> > interface and out the other?
> > #2. What in the world uses 15% cpu simply blocking packets in the
> > prerouting chain? I'm using NAPI and e1000 so i don't see how it could
> > even possibly use 15%
> >
> > Any ideas on how to debug or find out what's causing this?
> >
> > Thanks
> >
> > _______________________________________________
> > LARTC mailing list / LARTC@mailman.ds9a.nl
> > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
prev parent reply other threads:[~2004-06-05 0:12 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2004-06-04 23:07 [LARTC] iptables/cpu utilization Paul
2004-06-05 0:12 ` Paul [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1086394329.11341.30.camel@localhost.localdomain \
--to=xerox@foonet.net \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox