From owner-freebsd-jail@freebsd.org Thu Dec 21 22:35:05 2017 Return-Path: Delivered-To: freebsd-jail@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id EDF5DE8FF42; Thu, 21 Dec 2017 22:35:05 +0000 (UTC) (envelope-from trashcan@ellael.org) Received: from mx2.enfer-du-nord.net (mx2.enfer-du-nord.net [87.98.149.189]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 9129C7BD4B; Thu, 21 Dec 2017 22:35:04 +0000 (UTC) (envelope-from trashcan@ellael.org) Received: from [IPv6:2003:8c:2e04:e501:40cc:d10e:17c0:531] (p2003008C2E04E50140CCD10E17C00531.dip0.t-ipconnect.de [IPv6:2003:8c:2e04:e501:40cc:d10e:17c0:531]) by mx2.enfer-du-nord.net (Postfix) with ESMTPSA id 3z2mfn4J5GzD0; Thu, 21 Dec 2017 23:34:57 +0100 (CET) Content-Type: text/plain; charset=us-ascii Mime-Version: 1.0 (Mac OS X Mail 11.2 \(3445.5.20\)) Subject: Re: performance issue within VNET jail From: Michael Grimm In-Reply-To: <5A3C33BF.9050902@grosbein.net> Date: Thu, 21 Dec 2017 23:34:56 +0100 Cc: freebsd-jail@FreeBSD.org, freebsd-net@freebsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <998F52B1-F07C-4A2D-ABB5-3F86D7D4BD09@ellael.org> References: <4F5EE3F6-0163-4435-8726-56B0D4AE9FAF@ellael.org> <8102F5FD-DCFC-4EF8-A443-9E6C9EB1F467@ellael.org> <5A3C2C42.6060904@grosbein.net> <5DAD8B80-FE3C-49D2-A645-EE144474D5FE@ellael.org> <5A3C33BF.9050902@grosbein.net> To: Eugene Grosbein X-Virus-Scanned: clamav-milter 0.99.2 at mail X-Virus-Status: Clean X-Mailer: Apple Mail (2.3445.5.20) X-BeenThere: freebsd-jail@freebsd.org X-Mailman-Version: 2.1.25 Precedence: list List-Id: "Discussion about FreeBSD jail\(8\)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Dec 2017 22:35:06 -0000 Eugene Grosbein wrote: > 22.12.2017 4:59, Michael Grimm wrote: >>> Make sure and double check that your ESP packets do not get = fragmented. >>=20 >>=20 >> Hmm, I do not know how to achieve that. May the following tcpdump = excerpts answer your question, or do you want me to look somewhere else? >>=20 >> At hostA while downloading from hostB/jailX and "tcpdump -i extIF esp = -vv" >>=20 >> 22:52:42.341023 IP (tos 0x0, ttl 64, id 40481, offset 0, flags = [none], proto ESP (50), length 140) >> hostA > hostB: ESP(spi=3D0x01d9ec34,seq=3D0x5fe699), length 120 >> 22:52:42.341079 IP (tos 0x0, ttl 53, id 64310, offset 1480, flags = [none], proto ESP (50), length 100) >> hostB > hostA: ip-proto-50 >=20 > It shows non-zero offsets, so your ESP packets *are* fragmented. > I guess, this is the reason of your problems as fragmented ESP packets = are known to cause problems > due to different reasons. Simpliest way to avoid such issues is to = decrease MTU of IPSEC tunnel > and/or TCP MSS so that incapsulated ESP packets do not get fragmented. Well, you already helped me out with IPSEC very recently, and I already = did decrease my MTU from 1500 to 1490. That increased my tunnel = performance dramatically, already. Thanks, I will decrease MTU further. BUT: In this thread I did report that I already had decreased MTU for = testing purposes on all involved interfaces down to 1400 to no avail, = and that my performance issue is regarding downloads within VNET jails = using TCP, not ESP. The very same external interfaces do not show a = performance drop if connected via ESP tunnel, but when trying to = download files from the internet, and only when the download is started = within a VNET jail. At the host downloads are only limited by the = bandwidth provided by the hosting company. BUT: It might well be that I did completely misunderstood your reply = instead ;-) Thanks and regards, Michael