Date: Thu, 24 Jan 2008 17:39:41 +0200 From: Stefan Lambrev <stefan.lambrev@moneybookers.com> To: freebsd-pf@freebsd.org Subject: PF makes em0 taskq to eat 100% CPU Message-ID: <4798B13D.4080701@moneybookers.com>
next in thread | raw e-mail | index | archive | help
Hello,
I'm doing some tests and benchmarks and I'm testing pf on bridge firewall.
One of the specific tests is how PF will handle SYN flood from random
source addresses.
While the bridge is w/o activated PF, I see 12-14MB/s traffic.
When I enable the PF the traffic drops to 2-5MB/s and I'm starting to
see lost packets.
Here is what top -S shows when PF is not active:
25 root 1 -68 - 0K 16K - 1 34:45 26.37% em0
taskq - only 26% CPU used
but when I enable PF it (em0 taskq) goes up to 100% and packets are lost.
Here is the pf.conf used for tests:
#macros
ext_if="em0"
int_if="em1"
br_if="bridge0"
www="10.3.3.1"
#sets
set skip on lo0
set skip on $int_if
set skip on $br_if
set limit states 20000000
set limit src-nodes 15000
set optimization aggressive
table <abusive_hosts> persist file "/etc/abusive_hosts"
block log quick from <abusive_hosts> to any
block log quick from any to <abusive_hosts>
pass in quick on $ext_if proto tcp from any to $www port { 80, 443 }
flags S/SA keep state \
(source-track rule, max-src-conn-rate 150/10, max-src-states 250,
overload <abusive_hosts> flush global)
The number of states that I reach is little more then 2,000,000.
(20,000,000 is the limit that I enforce)
FreeBSD 7.0-RC1- Thu Jan 24 - amd64 - sched_ule
Please advise.
--
Best Wishes,
Stefan Lambrev
ICQ# 24134177
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4798B13D.4080701>