John-Mark Gurney
2015-Mar-16 13:20 UTC
35-40% performance drop releng9 vs releng10 openvpn
Mike Tancsa wrote this message on Sun, Mar 15, 2015 at 20:34 -0400:> As part of moving from a RELENG8 based image to a RELENG9 or 10, I was > doing some simple performance testing and found RELENG_9 to be quite a > bit faster when generating traffic through a pcengines APU (dual core, > AMD64, 2G of RAM). Both are using generic kernels > > blasting across an aes-128cbc tunnel, on releng9 I get > > > # dd if=/dev/zero | nc 10.3.24.25 500 > > 326002688 bytes transferred in 37.188139 secs (8766308 bytes/sec) > > > vs > > # dd if=/dev/zero | nc 10.3.24.25 500 > 146982400 bytes transferred in 27.750440 secs (5296579 bytes/sec) > on releng10. > > Both have identical pf rules, but disabling pf does not make much of a > difference in speed. > > I havent started checking any of the default tunables. The box will be > functioning as a VPN router and I was hoping to get at least 50Mb/s out > of it, and I can do that on RELENG9, but not 10. > Any ideas what to do with RELENG10 to get comparable performance out of it ?Since you have at test framework ready, you could generate some flame graphs[1] using dtrace to help see where things might be having an impact... These are very easy to generate, and posting them would be useful... [1] http://www.brendangregg.com/FlameGraphs/cpuflamegraphs.html -- John-Mark Gurney Voice: +1 415 225 5579 "All that I will do, has been done, All that I have, has not."
On 3/16/2015 9:20 AM, John-Mark Gurney wrote:> > Since you have at test framework ready, you could generate some flame > graphs[1] using dtrace to help see where things might be having an > impact... > > These are very easy to generate, and posting them would be useful... > > [1] http://www.brendangregg.com/FlameGraphs/cpuflamegraphs.htmlHi, I went through the steps to generate one. What args should I use for dtrace to generate the information that is helpful / useful ? For my setup, I have server1---------apu-------------server2 server1 has an openvpn tunnel to the apu I route server2's IP address across the VPN tunnel, so if I ping from server1 to server2's IP, it goes via the tunnel on the dtrace -x ustackframes=100 -n 'profile-99 /execname == "openvpn" && arg1/ { @[ustack()] = count(); } tick-30s { exit(0); }' -o 10.stacks which generated http://tancsa.com/10.svg ---Mike -- ------------------- Mike Tancsa, tel +1 519 651 3400 Sentex Communications, mike at sentex.net Providing Internet services since 1994 www.sentex.net Cambridge, Ontario Canada http://www.tancsa.com/