Mailing List Archive

Advanced Hosting UNIX Admin Daniel Fairchild wrote:
>
> I need some help here has anyone setup a linux fire wall with duel Gig NICs
> in it. For some reason It was only allowing 12Mbs accross the friwall I had
> the firewall set to accept and forward all traffic and to deny nothing.

An NAI paper exploring authentication overheads on fast networks
http://www.pgp.com/research/nailabs/cryptographic/adaptive-cryptographic.asp
gives some data that might be relevant.

Pentium II cycles per byte processed:

Linux IP stack alone: 5
doing IPsec but no crypto: 11

Presumably if you're doing IP twice, once in and once out, you need 10
cycles per byte just for that. To get gigabit throughput, you need 10/8
of a gigahertz just for that. That is, you need roughly a 1.3 GHz box
just to handle the traffic without any firewalling.

There was a good paper at last year's Ottawa Symposium on doing it
faster than that, though:
http://www.linuxsymposium.org/2000/routing.php

I've no real idea how expensive netfilter processing is. If it is about
as expensive as IP processing, then you appear to need at least a 2.6
GHz box to get gigabit throughput.

If it is much more expensive than that, as it almost certainly would be
with a highly complex set of firewall rules, you would appear to have
a really hard problem facing you.

This may be a situation where Linux on standard hardware cannot cut it.
Time to dig out a chequebook and the phone number for your Cisco rep?

Thus spake Sandy Harris:
>
> There was a good paper at last year's Ottawa Symposium on doing it
> faster than that, though:
> http://www.linuxsymposium.org/2000/routing.php
>

There doesn't actually seem to be a paper here, only a description of
it. Is it on-line somewhere?

Wil
--
W. Reilly Cooley wcooley@nakedape.cc
Naked Ape Consulting http://nakedape.cc
LNXS: Get 0.2.0-devel at http://sourceforge.net/projects/lnxs/
irc.openprojects.net #lnxs

Faith may be defined briefly as an illogical belief in the occurence of the
improbable.
- H. L. Mencken

Wil Cooley [SMTP:wcooley@nakedape.cc] wrote:
>Thus spake Sandy Harris:
>>
>> There was a good paper at last year's Ottawa Symposium on doing it
>> faster than that, though:
>> http://www.linuxsymposium.org/2000/routing.php
>>
>
>There doesn't actually seem to be a paper here, only a description of
>it. Is it on-line somewhere?

A quick google search turned this up:

http://lwn.net/2000/0928/a/fast-forwarding.php3

with a link to:

http://robur.slu.se/Linux/net-development/jamal/FF-html/

There are also mp3s from the Linux 2000 Symposium on:

http://www.linuxsymposium.org/audio.php

Regards,
Filip