Re: [Fwd: Linux 2.4 networking/routing slowdown]

Re: [Fwd: Linux 2.4 networking/routing slowdown]

[Lutz Vieweg]

Jan Kasprzak <kas@informatics.muni.cz> wrote:

> >         I have tried to upgrade my firewall to 2.4 kernel (2.4.7), and I have
> > observed a major slowdown of the network speed.

We observed a similar problem, hunted it down via kernel profiling:

When we used ipchains to establish a port redirection (just one
rule, map one port to another), the network would become rediculously
slow after some time of use, causing the CPU to spend almost 100%
as "system time".

We found that the expensive kernel functions were redir_cmp and unredir_cmp,
which were called an unreasonable amount of times by find_redir - seems the
iteration over the list there is quite lengthy...

We didn't investigate the problem further, but found that by using 
"iptables" instead of the obsolete "ipchains" to establish the redirection
rule, everything was fine again.

So my advice would be to try iptables and see if your problem goes away
as well.

Regards,

Lutz Vieweg

--
 Dipl. Phys. Lutz Vieweg | email: lkv@isg.de
 Innovative Software AG  | Phone/Fax: +49-69-505030 -120/-505
 Feuerbachstrasse 26-32  | http://www.isg.de/people/lkv/
 60325 Frankfurt am Main | ^^^ PGP key available here ^^^

Re: [Fwd: Linux 2.4 networking/routing slowdown]

[Jan Kasprzak]

Lutz Vieweg wrote:
: We didn't investigate the problem further, but found that by using 
: "iptables" instead of the obsolete "ipchains" to establish the redirection
: rule, everything was fine again.
: 
: So my advice would be to try iptables and see if your problem goes away
: as well.
: 
	Well, the problem is, that even without ipchains.o module
loaded, the server is not able to route even nearly close to 100Mbps.
I'd like to have it routing at port speeds before I'll try to dig into
ipchains/iptables.

-Yenya

-- 
\ Jan "Yenya" Kasprzak <kas at fi.muni.cz>       http://www.fi.muni.cz/~kas/
\\ PGP: finger kas at aisa.fi.muni.cz   0D99A7FB206605D7 8B35FCDE05B18A5E //
\\\             Czech Linux Homepage:  http://www.linux.cz/              ///
--Just returned after being 10 days off-line. Sorry for the delayed reply.--

Re: [Fwd: Linux 2.4 networking/routing slowdown]

[Jan Kasprzak]

[Cc'd linux-kernel as well, maybe this can help someone]

craig.schlenter@freemail.absa.co.za wrote:
: Are you sure the network cards are running at full speed - perhaps
: something has decided to run at half duplex or whatever due to a network
: driver change ... how about putting the box on the network without
: having it do any routing and just doing a couple of ftp's to other local
: machines to check the speeds with 2.2 and 2.4 kernels, testing all the cards
: involved ...

	The NICs on firewall are set up to 100baseTX-FD using /sbin/mii-tool
(and in 2.2. kernel, they are hardcoded to 100baseTX-FD via the boot
parameters).

	The FTP from firewall to our FTP server (which is connected to the
same switch - Cisco Catalyst 2900) is slow as well (I tried to
get /pub/FILES.byname /dev/null).

-Y.

-- 
\ Jan "Yenya" Kasprzak <kas at fi.muni.cz>       http://www.fi.muni.cz/~kas/
\\ PGP: finger kas at aisa.fi.muni.cz   0D99A7FB206605D7 8B35FCDE05B18A5E //
\\\             Czech Linux Homepage:  http://www.linux.cz/              ///
--Just returned after being 10 days off-line. Sorry for the delayed reply.--