From owner-freebsd-net@freebsd.org Sun May 2 13:48:39 2021 Return-Path: Delivered-To: freebsd-net@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 06EDF62628B for ; Sun, 2 May 2021 13:48:39 +0000 (UTC) (envelope-from bu7cher@yandex.ru) Received: from forward100j.mail.yandex.net (forward100j.mail.yandex.net [IPv6:2a02:6b8:0:801:2::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 4FY6rj68KTz4hfc for ; Sun, 2 May 2021 13:48:37 +0000 (UTC) (envelope-from bu7cher@yandex.ru) Received: from sas1-ad61ad785433.qloud-c.yandex.net (sas1-ad61ad785433.qloud-c.yandex.net [IPv6:2a02:6b8:c08:37a4:0:640:ad61:ad78]) by forward100j.mail.yandex.net (Yandex) with ESMTP id CF5EF50E05DA; Sun, 2 May 2021 16:48:33 +0300 (MSK) Received: from sas1-37da021029ee.qloud-c.yandex.net (sas1-37da021029ee.qloud-c.yandex.net [2a02:6b8:c08:1612:0:640:37da:210]) by sas1-ad61ad785433.qloud-c.yandex.net (mxback/Yandex) with ESMTP id y5J4orBbjN-mXHOTpjL; Sun, 02 May 2021 16:48:33 +0300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex.ru; s=mail; t=1619963313; bh=UURLIV7aJt3SVfV+o8lBHmial3sB2rxNCtIpHgMggEA=; h=In-Reply-To:From:Date:References:To:Subject:Message-ID; b=fkSPqJQMTGkMDdoBuiZ7bjhwD2wJ/PrfWN/GQYcEp4NlVF8cu7g4lXFq6qrdINkIT kG18uDN3Qa8OvWI2o8xcSx6ZUe3XRhhIGxdpgfMs5qhoB3u8xbJg5IYcj3UEgEjqhR zQ0ddXngBeZ+xD1khEi8iaP65BquQFjt946mRgqM= Received: by sas1-37da021029ee.qloud-c.yandex.net (smtp/Yandex) with ESMTPSA id HxaAH0hE2Y-mXLOlZFR; Sun, 02 May 2021 16:48:33 +0300 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (Client certificate not present) Subject: Re: IPsec performace - netisr hits %100 To: =?UTF-8?Q?=c3=96zkan_KIRIK?= , FreeBSD Net References: From: "Andrey V. Elsukov" Message-ID: <6fb8384a-5fe6-9d59-6e35-09b72bd79c30@yandex.ru> Date: Sun, 2 May 2021 16:48:32 +0300 User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="55swJcWbEueFWtwL9iIn3zNBPatPykmix" X-Rspamd-Queue-Id: 4FY6rj68KTz4hfc X-Spamd-Bar: ------ Authentication-Results: mx1.freebsd.org; dkim=pass header.d=yandex.ru header.s=mail header.b=fkSPqJQM; dmarc=pass (policy=none) header.from=yandex.ru; spf=pass (mx1.freebsd.org: domain of bu7cher@yandex.ru designates 2a02:6b8:0:801:2::100 as permitted sender) smtp.mailfrom=bu7cher@yandex.ru X-Spamd-Result: default: False [-6.10 / 15.00]; FREEMAIL_FROM(0.00)[yandex.ru]; R_SPF_ALLOW(-0.20)[+ip6:2a02:6b8:0::/52]; HAS_ATTACHMENT(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; TO_DN_ALL(0.00)[]; DKIM_TRACE(0.00)[yandex.ru:+]; RCPT_COUNT_TWO(0.00)[2]; DMARC_POLICY_ALLOW(-0.50)[yandex.ru,none]; NEURAL_HAM_SHORT(-1.00)[-0.995]; SIGNED_PGP(-2.00)[]; FREEMAIL_TO(0.00)[gmail.com,freebsd.org]; RCVD_IN_DNSWL_LOW(-0.10)[2a02:6b8:0:801:2::100:from]; RCVD_TLS_LAST(0.00)[]; MIME_TRACE(0.00)[0:+,1:+,2:+,3:~]; FREEMAIL_ENVFROM(0.00)[yandex.ru]; MID_RHS_MATCH_FROM(0.00)[]; RBL_DBL_DONT_QUERY_IPS(0.00)[2a02:6b8:0:801:2::100:from]; ASN(0.00)[asn:13238, ipnet:2a02:6b8::/32, country:RU]; DWL_DNSWL_NONE(0.00)[yandex.ru:dkim]; ARC_NA(0.00)[]; R_DKIM_ALLOW(-0.20)[yandex.ru:s=mail]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; NEURAL_HAM_MEDIUM(-0.90)[-0.903]; NEURAL_HAM_LONG(-1.00)[-1.000]; TAGGED_RCPT(0.00)[]; MIME_GOOD(-0.20)[multipart/signed,multipart/mixed,text/plain]; SPAMHAUS_ZRD(0.00)[2a02:6b8:0:801:2::100:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; MAILMAN_DEST(0.00)[freebsd-net] X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 May 2021 13:48:39 -0000 This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --55swJcWbEueFWtwL9iIn3zNBPatPykmix Content-Type: multipart/mixed; boundary="Dmp2wHxJlcZPTXhJ2rsNwVvmgJIiDawK0"; protected-headers="v1" From: "Andrey V. Elsukov" To: =?UTF-8?Q?=c3=96zkan_KIRIK?= , FreeBSD Net Message-ID: <6fb8384a-5fe6-9d59-6e35-09b72bd79c30@yandex.ru> Subject: Re: IPsec performace - netisr hits %100 References: In-Reply-To: --Dmp2wHxJlcZPTXhJ2rsNwVvmgJIiDawK0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: quoted-printable 30.04.2021 23:11, =C3=96zkan KIRIK =D0=BF=D0=B8=D1=88=D0=B5=D1=82: > Hello, >=20 > I'm using FreeBSD stable/12 built world on 12 April 2021. > my setup is: > [freebsd host cc0] <--------> [cc1 - same freebsd, but jail] >=20 > without IPsec, I can achieve easily to 20Gbps. (test was run with diffe= rent > source IPs using multiple iperf to scale across multiple queues) > My hardware is Xeon D-2146NT (8 core + SoC Qat), cc0 and cc1 is Chelsio= > T62100-LP-CR. I suspect you are using 9k MTU on cc(4) interfaces. If you set bigger MTU on the if_ipsec(4) interfaces, this can increase throughput. --=20 WBR, Andrey V. Elsukov --Dmp2wHxJlcZPTXhJ2rsNwVvmgJIiDawK0-- --55swJcWbEueFWtwL9iIn3zNBPatPykmix Content-Type: application/pgp-signature; name="OpenPGP_signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="OpenPGP_signature" -----BEGIN PGP SIGNATURE----- wsB5BAABCAAjFiEE5lkeG0HaFRbwybwAAcXqBBDIoXoFAmCOrbAFAwAAAAAACgkQAcXqBBDIoXpg NwgAmm4QtsWn/gaHoFXmHA6SyJQjCnd7xtlMSzb4MEfiMLZS3HR6JJtX8GHMVqGnyfbens2H2ETc WW3QRVeHUIEs0cXlC+xkNWl/1IV4r0X8RribzbATVtYEM+hbMpFw77r3gGmz6jL1HljHIEbpCah8 E7QJy+GWkY5Fwc27+T6lHd97LFfsQYZvqe5QnBs0otlyVj5hLaVC1UWWIheQQcQq+3s+yqu5hKEd V7lLaNorwC36VzB1NWouS09DEchfvd5C35ou5l1f3UAak/vec0YgTDSeUsLRSCtbB0j/6M1leHNW ccvmxR4LZ4YVEoYzJ9uikvqEHpnxCuc5DODcCflkWw== =uCuc -----END PGP SIGNATURE----- --55swJcWbEueFWtwL9iIn3zNBPatPykmix--