From owner-freebsd-net@FreeBSD.ORG Thu Jun 19 13:00:12 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id AE08737B401 for ; Thu, 19 Jun 2003 13:00:12 -0700 (PDT) Received: from laptop.tenebras.com (laptop.tenebras.com [66.92.188.18]) by mx1.FreeBSD.org (Postfix) with SMTP id 033B443F85 for ; Thu, 19 Jun 2003 13:00:10 -0700 (PDT) (envelope-from kudzu@tenebras.com) Received: (qmail 17549 invoked from network); 19 Jun 2003 20:00:09 -0000 Received: from sapphire.tenebras.com (HELO tenebras.com) (192.168.188.241) by 0 with SMTP; 19 Jun 2003 20:00:09 -0000 Message-ID: <3EF21648.8080205@tenebras.com> Date: Thu, 19 Jun 2003 13:00:08 -0700 From: Michael Sierchio User-Agent: Mozilla/5.0 (X11; U; Linux i386; en-US; rv:1.3.1) Gecko/20030425 X-Accept-Language: en-us, zh-tw, zh-cn, fr, en, de-de MIME-Version: 1.0 To: Tom Daly References: In-Reply-To: Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-net@freebsd.org Subject: Re: Firewall Performance Question. X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 19 Jun 2003 20:00:13 -0000 Tom Daly wrote: > I am currently running a Dell Poweredge 350 with FreeBSD 4.7 as a network > firewall for one of our sites. This site sees about 3 megabits of traffic. per some unit of time, I presume? ;-) maybe 3Mbit/s? > The average firewall ruleset runs around 600-800 rules, running on IPFW. That's a huge number of rules -- do you have any idea what number of packets are checked against how many rules before being accepted or denied? A histogram would be nice.... > Could this be a direct cause of why my system's interrupt usage is over > 50% at many times, as well as sending ICMP source quenchs from time to > time? > > Can anyone suggest a performance tweak to help this box along? Without seeing the ruleset, I'd venture a guess that IPFW2 would help reduce the number of rules, and that a clever refactoring (with poss. use of skipto rules) might reduce the load. -- "Well," Brahma said, "even after ten thousand explanations, a fool is no wiser, but an intelligent man requires only two thousand five hundred." - The Mahabharata