netfilter CPU usage

netfilter CPU usage

[lartc]

Hello

Can someone tell me just how intensive netfilter is towards CPU?

Is it posible for 6000 rules with no target set in the FORWARD chain to
eat up about 60% of my P4 2.4 GHz?

Re: netfilter CPU usage

[Antony Stone]

On Sunday 13 June 2004 12:30 pm, lartc@ssi.bg wrote:

> Hello
>
> Can someone tell me just how intensive netfilter is towards CPU?
>
> Is it posible for 6000 rules with no target set in the FORWARD chain to
> eat up about 60% of my P4 2.4 GHz?

I would be very surprised at this, however you haven't said what sort of 
bandwidth you're shovelling through the machine, and this will clearly make a 
difference to the CPU usage.

Also, when you say "6000 rules with no target set", I assume this means that 
each packet is traversing all 6000 rules (presumably for some sort of 
accounting process), and then getting to the bottom of the table and doing 
something more interesting...

One simple way of identifying whether it's the 6000 rules which are consuming 
60% of your CPU would be to temporarily reduce the ruleset to 2000 or 3000 
and see if you get a noticeable reduction in CPU usage (I wouldn't expect it 
to be proportional, so don't look for 20% or 30%, but if it doesn't go down 
by much, you know it's not the 6000 rules causing the load).

How memory is in the machine?

Are you using connection tracking (if so, how many connections are in 
/proc/net./ip_conntrack)?

Regards,

Antony.

-- 
The difference between theory and practice is that in theory there is no 
difference, whereas in practice there is.

                                                     Please reply to the list;
                                                           please don't CC me.

Re: netfilter CPU usage

[lartc]

> On Sunday 13 June 2004 12:30 pm, lartc@ssi.bg wrote:
>
>> Hello
>>
>> Can someone tell me just how intensive netfilter is towards CPU?
>>
>> Is it posible for 6000 rules with no target set in the FORWARD chain to
>> eat up about 60% of my P4 2.4 GHz?
>
> I would be very surprised at this, however you haven't said what sort of
> bandwidth you're shovelling through the machine, and this will clearly
> make a difference to the CPU usage.

yes - the bandwidth was the issue. thanks for the help.

Re: netfilter CPU usage

[John A. Sullivan III]

On Sun, 2004-06-13 at 11:26, Antony Stone wrote:
> On Sunday 13 June 2004 12:30 pm, lartc@ssi.bg wrote:
> 
> > Hello
> >
> > Can someone tell me just how intensive netfilter is towards CPU?
> >
> > Is it posible for 6000 rules with no target set in the FORWARD chain to
> > eat up about 60% of my P4 2.4 GHz?
> 
> I would be very surprised at this, however you haven't said what sort of 
> bandwidth you're shovelling through the machine, and this will clearly make a 
> difference to the CPU usage.
> 
> Also, when you say "6000 rules with no target set", I assume this means that 
> each packet is traversing all 6000 rules (presumably for some sort of 
> accounting process), and then getting to the bottom of the table and doing 
> something more interesting...
> 
> One simple way of identifying whether it's the 6000 rules which are consuming 
> 60% of your CPU would be to temporarily reduce the ruleset to 2000 or 3000 
> and see if you get a noticeable reduction in CPU usage (I wouldn't expect it 
> to be proportional, so don't look for 20% or 30%, but if it doesn't go down 
> by much, you know it's not the 6000 rules causing the load).
> 
> How memory is in the machine?
> 
> Are you using connection tracking (if so, how many connections are in 
> /proc/net./ip_conntrack)?
> 
> Regards,
> 
> Antony.
How are you loading the rules? Is this high CPU utilization during the
load sequence or are you certain the rules have already loaded and you
still have such high CPU utilization? One should use the
iptables-restore method of loading when using so many rules.  Doing 6000
iptables commands will put a terrible load on the system and take
forever to load - John
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net