From owner-freebsd-security  Tue Nov  6 22:46:20 2001
Delivered-To: freebsd-security@freebsd.org
Received: from obsecurity.dyndns.org (adsl-63-207-60-80.dsl.lsan03.pacbell.net [63.207.60.80])
	by hub.freebsd.org (Postfix) with ESMTP id 6630737B417
	for <freebsd-security@freebsd.org>; Tue,  6 Nov 2001 22:46:17 -0800 (PST)
Received: by obsecurity.dyndns.org (Postfix, from userid 1000)
	id 05E1566B10; Tue,  6 Nov 2001 22:46:16 -0800 (PST)
Date: Tue, 6 Nov 2001 22:46:16 -0800
From: Kris Kennaway <kris@obsecurity.org>
To: Nick Slager <ns@BlueSkyFrog.COM>
Cc: freebsd-security@freebsd.org
Subject: Re: KAME IPsec on low-end hardware
Message-ID: <20011106224616.A37425@xor.obsecurity.org>
References: <20011107163846.H25762@BlueSkyFrog.COM>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-md5;
	protocol="application/pgp-signature"; boundary="MGYHOYXEY6WxJCY8"
Content-Disposition: inline
User-Agent: Mutt/1.2.5i
In-Reply-To: <20011107163846.H25762@BlueSkyFrog.COM>; from ns@BlueSkyFrog.COM on Wed, Nov 07, 2001 at 04:38:46PM +1000
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org


--MGYHOYXEY6WxJCY8
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Nov 07, 2001 at 04:38:46PM +1000, Nick Slager wrote:

> box1 ~ % ping box2
> PING box2.internal (192.168.2.1): 56 data bytes
> 64 bytes from 192.168.2.1: icmp_seq=3D0 ttl=3D63 time=3D35.338 ms
> 64 bytes from 192.168.2.1: icmp_seq=3D1 ttl=3D63 time=3D34.032 ms
> 64 bytes from 192.168.2.1: icmp_seq=3D2 ttl=3D63 time=3D33.999 ms
>=20
> With IPsec not active, response times are "normal" (~ 0.5ms)
>=20
> I'm guessing these high response times are due to the low end hardware
> in use. Box 1 is a 486DX4/100; Box 2 is a P90 (no laughing please!).
> Would this assumption be correct?

Seems reasonable.  Your throughput will definitely be CPU-bound here.

Kris

--MGYHOYXEY6WxJCY8
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE76Ni4Wry0BWjoQKURAuwCAKCsCTaLNeHV/eUkwQOjB4i9KvgA0gCfTGeg
zGbJ4fRoNg7M860cnH24Bnk=
=uCoY
-----END PGP SIGNATURE-----

--MGYHOYXEY6WxJCY8--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message