Date: Sun, 21 Mar 2021 17:18:29 -0700 From: Adrian Chadd <adrian.chadd@gmail.com> To: =?UTF-8?B?w5Z6a2FuIEtJUklL?= <ozkan.kirik@gmail.com> Cc: Hans Petter Selasky <hps@selasky.org>, FreeBSD Net <freebsd-net@freebsd.org> Subject: Re: RSS on FreeBSD stable/12 gateway Message-ID: <CAJ-VmonORofajMLwRjuzCOwst6zGt5fi-aEepjnq78MD1pRwpw@mail.gmail.com> In-Reply-To: <CAAcX-AHNCF0YuM94%2BvaeqntdGcPA70mtzYvMnk1yftk%2BPeo2gQ@mail.gmail.com> References: <CAAcX-AFisP=r_VJ0_Ta-QhBsG%2BoEwvVHn%2Bpx5Lvt5m4_ff1gsw@mail.gmail.com> <ebec2fdc-c145-66ca-9274-9cbe31b43d0b@selasky.org> <CAAcX-AGGmxsO8rKs-kx8U05F7qkQuXdn=Bm4FPFkta_uWBye7w@mail.gmail.com> <CAJ-VmomKcW6ihaGLxm1Tu%2BuFDTq1sVTbT5tz6TfDgeYLhB%2BgoQ@mail.gmail.com> <CAAcX-AHNCF0YuM94%2BvaeqntdGcPA70mtzYvMnk1yftk%2BPeo2gQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 13 Mar 2021 at 23:24, =C3=96zkan KIRIK <ozkan.kirik@gmail.com> wrot= e: > > Hello Adrian, > > I wonder if the current RSS code supports software mode. Is it possible t= o enforce software RSS? And what about Sender Side Scaling ? The current RSS code does enforce it on all the NICs, so if you enable it and you don't have hardware RSS then the kernel will rehash things in software for you. It has to support software RSS anyway because of how fragments work - NICs will only do 2-tuple hashing on fragments (as there's no port info in the fragment.) So, the received queue for the fragment doesn't match the received-queue for the first packet in the frame, and it ends up being reinjected correctly once the frame is fully received. > I want to assign a snort instance for each NIC queue. Snort is configured= to use netmap mode. Needs and questions are below: > - For a proper detection, both of request and response packets must enter= into same snort instance so that same NIC queue. For example 3way handshak= e packets, TLS handshake packets and etc all must use same queue for both d= irections. Then you need to use a symmetric RSS key! > - I'm afraid that, option RSS is only socket aware. But gateways/routers = doesnt have sockets for all connections. Is it possible to perform such has= hing and requeuing while forwarding packets? It's .. more complicated than that. > - On receive side, is it possible to hashing & requeuing before the netma= p step? > - On sender side, is it possible to hashing & queuing before pushing in N= IC queue? So, when I last left it (and what we were doing at Norse a few years ago) w= as: * using RSS * using a symmetric RSS key * Intel ixgbe 10GB, chelso 10GB/40GB NICs would then use the system RSS key and queue configuration. Now, notably I haven't hacked on this since then and it's possible something has crept in with the advent of iflib that may have messed this up - but my intention when fixing up RSS in FreeBSD was to continue using the notion that the whole "system" had an RSS key. All drivers and software hashing would all use the same key and tuple configuration where appropriate, so things would "just line up". Now, this isn't as flexible as the Linux way where you can configure it per-NIC but I wanted to avoid scenarios where you'd mess up the config and suddenly your traffic didn't work right at all. -adrian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ-VmonORofajMLwRjuzCOwst6zGt5fi-aEepjnq78MD1pRwpw>