From: David Miller <davem@davemloft.net>
To: linux@stwm.de
Cc: netdev@vger.kernel.org, fw@strlen.de,
steffen.klassert@secunet.com, linux-kernel@vger.kernel.org,
torvalds@linux-foundation.org, christophe.gouault@6wind.com,
gregkh@linuxfoundation.org
Subject: Re: Regression: kernel 4.14 an later very slow with many ipsec tunnels
Date: Thu, 25 Oct 2018 10:34:50 -0700 (PDT) [thread overview]
Message-ID: <20181025.103450.1966639999117342457.davem@davemloft.net> (raw)
In-Reply-To: <2766296.15tpkxTHJV@stwm.de>
From: Wolfgang Walter <linux@stwm.de>
Date: Thu, 25 Oct 2018 11:38:19 +0200
> there is now a new 4.19 which still has the big performance regression when
> many ipsec tunnels are configured (throughput and latency get worse by 10 to
> 50 times) which makes any kernel > 4.9 unusable for our routers.
>
> I still don't understand why a revert of the flow cache removal at least for
> the longterm kernels is that a bad option (maybe as a compile time option),
> especially as there is no workaround available.
You do know that the flow cache is DDoS targettable, right?
That's why we removed it, we did not make the change lightly.
Adding a DDoS vector back into the kernel is not an option sorry.
Please work diligently with Florian and others to try and find ways to
soften the performance hit.
Thank you.
next prev parent reply other threads:[~2018-10-25 17:34 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-13 11:30 Regression: kernel 4.14 an later very slow with many ipsec tunnels Wolfgang Walter
2018-09-13 13:58 ` Florian Westphal
2018-09-13 15:46 ` Wolfgang Walter
2018-09-13 16:38 ` Florian Westphal
2018-09-13 17:23 ` David Miller
2018-09-13 21:03 ` Florian Westphal
2018-09-13 21:12 ` David Miller
2018-09-14 5:06 ` Steffen Klassert
2018-09-14 5:54 ` Florian Westphal
2018-09-14 6:01 ` Steffen Klassert
2018-09-14 8:01 ` Christophe Gouault
2018-09-14 11:49 ` Wolfgang Walter
2018-10-02 14:45 ` Wolfgang Walter
2018-10-02 14:56 ` Florian Westphal
2018-10-02 17:34 ` Wolfgang Walter
2018-10-02 21:35 ` Florian Westphal
2018-10-04 13:57 ` Wolfgang Walter
2018-10-25 9:38 ` Wolfgang Walter
2018-10-25 17:34 ` David Miller [this message]
2018-10-25 19:24 ` Florian Westphal
2018-10-26 12:18 ` Wolfgang Walter
2018-10-25 22:45 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181025.103450.1966639999117342457.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=christophe.gouault@6wind.com \
--cc=fw@strlen.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@stwm.de \
--cc=netdev@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).