Date: Wed, 25 Jan 2012 18:44:52 -0800 From: Matthew Luckie <mjl@luckie.org.nz> To: freebsd-net@freebsd.org Subject: high cpu usage on natd / dhcpd Message-ID: <4F20BE24.3050101@luckie.org.nz>
next in thread | raw e-mail | index | archive | help
Hi I have a small system running FreeBSD 8.2 that does NAT using ipfw and natd to systems attached to two interfaces: em0 and wlan0. I have a dhcpd daemon issuing leases on those interfaces. The system has an em1 interface plugged into a cable modem where it obtains a DHCP lease from an ISP. For some reason, when traffic from the Internet terminates on the system itself (I scp a file from the computer) the natd and dhcpd processes consume significant CPU, and the throughput is less than I expect. Traffic that passes through to a computer behind the NAT flows without causing the natd or dhcpd processes to measurably consume CPU. From top: CPU: 10.9% user, 0.0% nice, 56.0% system, 21.1% interrupt, 12.0% idle Mem: 225M Active, 92M Inact, 162M Wired, 556K Cache, 112M Buf, 1506M Free PID USERNAME THR PRI NICE SIZE RES STATE TIME WCPU COMMAND 1222 root 1 104 0 3572K 1448K RUN 1:29 39.36% natd 1676 root 1 62 0 5340K 3544K select 0:59 24.56% dhcpd What is going on? My ipfw ruleset is below, and is based on the example in the FreeBSD handbook. 00001 allow ip from any to any via lo0 00002 allow ip from any to any via em0 00003 allow ip from any to any via wlan0 00101 divert 8668 ip from any to any in via em1 00102 check-state 00110 skipto 500 tcp from any to any out via em1 setup keep-state 00111 skipto 500 udp from any to any out via em1 keep-state 00112 skipto 500 icmp from any to any out via em1 keep-state 00201 allow udp from any to any dst-port 68 in keep-state 00202 allow tcp from any to me dst-port 80 in via em1 setup keep-state 00210 allow tcp from 130.217.250.13 to me in via em1 setup keep-state 00211 allow tcp from 199.109.33.1 to me in via em1 setup keep-state 00212 allow tcp from 192.172.226.78 to me in via em1 setup keep-state 00213 allow tcp from 192.172.226.95 to me in via em1 setup keep-state 00230 allow tcp from any to me dst-port 6984 in via em1 setup keep-state 00231 allow udp from any to me dst-port 6984 in via em1 00240 allow icmp from any to me in via em1 00300 unreach filter-prohib log ip from any to any 00500 divert 8668 ip from any to any out via em1 00501 allow ip from any to any 65535 allow ip from any to any
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4F20BE24.3050101>