Date: Thu, 23 Feb 2023 04:28:55 +0100 (CET) From: Sysadmin Lists <sysadmin.lists@mailfence.com> To: freebsd-fs <freebsd-fs@freebsd.org> Cc: Miroslav Lachman <000.fbsd@quip.cz>, Freddie Cash <fjwcash@gmail.com> Subject: Re: speeding up zfs send | recv (update) Message-ID: <741387429.91447.1677122934622@ichabod.co-bxl> In-Reply-To: <CAOjFWZ7k7ANwcGyNCoYMg%2BLUBzAz2VyNfxQo5rKcrYj8XFgG3Q@mail.gmail.com> References: <866d6937-a4e8-bec3-d61b-07df3065fca9@sentex.net> <CAOtMX2gifUmgqwSKpRGcfzCm_=BX_szNF1AF8WTMfAmbrJ5UWA@mail.gmail.com> <f6ea3387-faf8-4c63-d1e7-906fa397b00b@sentex.net> <a38578c6-b633-249d-90f0-0652377d76c0@quip.cz> <c229a502-fb76-ec6a-a56b-934d3b56e474@sentex.net> <1031e2b0-b245-1dc6-a499-8f4da3796543@quip.cz> <46455168-d7f1-6ca9-ad2f-9bcd3359e0f3@sentex.net> <78c78aec-a34b-f188-ef96-8ced9a1eda35@quip.cz> <CAOjFWZ7k7ANwcGyNCoYMg%2BLUBzAz2VyNfxQo5rKcrYj8XFgG3Q@mail.gmail.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On Feb 22, 2023 at 1:43 PM, Freddie Cash <fjwcash@gmail.com> wrote: [Sorry for top part, GMail sucks for replies.] If this is a LAN or private WAN where you trust the network, piping the send stream through netcat will remove ssh from the equation. That's what we switched to using once it became almost impossible to get the "none" cipher working with ssh on FreeBSD. We use ssh to connect to the remote server and enable a netcat listener on port X, then pipe the send through netcat to the remote system on port X. That way it's logged and uses ssh for authentication. We easily saturate gigabit links between our ZFS systems using netcat. Cheers, Freddie Typos due to smartphone keyboard. On Wed., Feb. 22, 2023, 1:31 p.m. Miroslav Lachman, <000.fbsd@quip.cz> wrote: On 22/02/2023 22:08, mike tancsa wrote: > On 2/22/2023 4:03 PM, Miroslav Lachman wrote: >> Interresting numbers. I think I am the only one who get best speed >> with chacha20-poly1305@openssh.com >> >> >> It seems the speed of SSH is limited by single core performance which >> is very poor on this machine (Intel(R) Pentium(R) Dual CPU E2160). >> Even if CPU has 50% idle, ssh runs on 99.8% of single core. > > The CPU I have has > aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS> on motherboard > > which probably helps. That explains it aesni0: No AES or SHA support. >> I know there were some HPN patches to ssh, beside that is there any >> option I can try to use less CPU? >> >> I will play with cpuset to pin ssh on one core and everything else on >> the other core. > > It looks like you are running into a CPU bottleneck TBH Yes. Pinning on cores with cpuset helps a bit (about +3MiB/s) but without some tweaks on ssh I will not gain more speed :( Thank you for your help! Miroslav Lachman You could pipe the stream through an encrypting program before piping to netcat, then decrypt on the recieving end. $ zfs send | crypt | netcat ipaddr 2222 $ netcat -vl 2222 | crypt | zfs recv I don't know if zfs can handle that, but worth a try. $ man crypt The enigma utility, also known as crypt is a very simple encryption program, working on a “secret-key” basis. It operates as a filter, i.e., it encrypts or decrypts a stream of data from standard input, and writes the result to standard output. Since its operation is fully symmetrical, feeding the encrypted data stream again through the engine (using the same secret key) will decrypt it. -- Sent with https://mailfence.com Secure and private email [-- Attachment #2 --] <div style='font-family:Times New Roman; color:#000000; font-size:18px;'><br><div>On Feb 22, 2023 at 1:43 PM, Freddie Cash <fjwcash@gmail.com> wrote:<blockquote type="cite" cite="<CAOjFWZ7k7ANwcGyNCoYMg+LUBzAz2VyNfxQo5rKcrYj8XFgG3Q@mail.gmail.com>"><div dir="auto">[Sorry for top part, GMail sucks for replies.]<div dir="auto"><br></div><div dir="auto">If this is a LAN or private WAN where you trust the network, piping the send stream through netcat will remove ssh from the equation.<div dir="auto"><br></div><div dir="auto">That's what we switched to using once it became almost impossible to get the "none" cipher working with ssh on FreeBSD.</div><div dir="auto"><br></div><div dir="auto">We use ssh to connect to the remote server and enable a netcat listener on port X, then pipe the send through netcat to the remote system on port X. That way it's logged and uses ssh for authentication.</div><div dir="auto"><br></div><div dir="auto">We easily saturate gigabit links between our ZFS systems using netcat.<br></div><div dir="auto"><br></div><div dir="auto"><br><br><div data-smartmail="gmail_signature" dir="auto">Cheers,<br>Freddie<br><br>Typos due to smartphone keyboard.</div></div></div></div><br><div class=""><div dir="ltr" class="">On Wed., Feb. 22, 2023, 1:31 p.m. Miroslav Lachman, <<a href="mailto:000.fbsd@quip.cz">000.fbsd@quip.cz</a>> wrote:<br></div><blockquote class="" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 22/02/2023 22:08, mike tancsa wrote:<br> > On 2/22/2023 4:03 PM, Miroslav Lachman wrote:<br> >> Interresting numbers. I think I am the only one who get best speed <br> >> with <a href="mailto:chacha20-poly1305@openssh.com" target="_blank" rel="noreferrer">chacha20-poly1305@openssh.com</a><br> >><br> >><br> >> It seems the speed of SSH is limited by single core performance which <br> >> is very poor on this machine (Intel(R) Pentium(R) Dual CPU E2160). <br> >> Even if CPU has 50% idle, ssh runs on 99.8% of single core.<br> > <br> > The CPU I have has<br> > aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS> on motherboard<br> > <br> > which probably helps.<br> <br> That explains it<br> aesni0: No AES or SHA support.<br> <br> >> I know there were some HPN patches to ssh, beside that is there any <br> >> option I can try to use less CPU?<br> >><br> >> I will play with cpuset to pin ssh on one core and everything else on <br> >> the other core.<br> > <br> > It looks like you are running into a CPU bottleneck TBH<br> <br> Yes. Pinning on cores with cpuset helps a bit (about +3MiB/s) but <br> without some tweaks on ssh I will not gain more speed :(<br> <br> Thank you for your help!<br> <br> Miroslav Lachman<br> <br> <br></blockquote></div></blockquote><div><br></div><div><div>You could pipe the stream through an encrypting program before piping to</div><div>netcat, then decrypt on the recieving end.</div><div><br></div><div>$ zfs send | crypt | netcat ipaddr 2222</div><div>$ netcat -vl 2222 | crypt | zfs recv</div><div><br></div><div>I don't know if zfs can handle that, but worth a try.</div></div><div><br></div><div>$ man crypt</div><div><div> The enigma utility, also known as crypt is a very simple encryption</div><div> program, working on a “secret-key” basis. It operates as a filter, i.e.,</div><div> it encrypts or decrypts a stream of data from standard input, and writes</div><div> the result to standard output. Since its operation is fully symmetrical,</div><div> feeding the encrypted data stream again through the engine (using the</div><div> same secret key) will decrypt it.</div></div><div><br></div><div><br></div></div></div> -- Sent with https://mailfence.com Secure and private emailhelp
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?741387429.91447.1677122934622>