Shorewall users - Nov 2004 - Performance problems on Intel E100 (Shawn Wright)

>From: "Shawn Wright" <swright@sls.bc.ca>
>Subject: [Shorewall-users] Finally making some progress
>I *think* we are finally making some progress in tracking our elusive 
>performance problems. After employing a second 10Mb link from our ISP, 
>along with another firewall box and proxy, we were able to determine the 
>problem *is* our firewall. We don''t know exactly why yet, but our
sporadic
>slow web access seems to have gone away since swapping a new firewall 
>in this morning.
>The original firewall is a PPro200 with 256Mb, an Intel E100 
I''ve had much trouble with Intel E100 NIC''s. The problem can
be fixed using the e100 driver instead of the eepro100 driver.

When I first saw the problem, I could avoid it by passing the network signal via
an old 10Mbit/s hub - the driver seems to miss interrupts when running in 100
MBit/s full duplex mode and then fall back to polling which is very slow.

More info can be found here:

http://www.cs.helsinki.fi/linux/linux-kernel/2002-07/0274.html

Best regards,
Niels Kristian Jensen
Denmark

On 27 Nov 2004 at 10:48, Niels Kristian Jensen wrote:
> >From: "Shawn Wright" <swright@sls.bc.ca>
> >Subject: [Shorewall-users] Finally making some progress
> 
> >I *think* we are finally making some progress in tracking our elusive 
> >performance problems. After employing a second 10Mb link from our ISP, 
> >along with another firewall box and proxy, we were able to determine
the
> >problem *is* our firewall. We don''t know exactly why yet, but
our sporadic
> >slow web access seems to have gone away since swapping a new firewall 
> >in this morning.
> 
> >The original firewall is a PPro200 with 256Mb, an Intel E100 
> 
> I''ve had much trouble with Intel E100 NIC''s. The problem
can be fixed using the e100 driver instead of the eepro100 driver.
> 
> When I first saw the problem, I could avoid it by passing the network
signal via an old 10Mbit/s hub - the driver seems to miss interrupts when
running in 100 MBit/s full duplex mode and then fall back to polling which is
very slow.
> 
> More info can be found here:
> 
> http://www.cs.helsinki.fi/linux/linux-kernel/2002-07/0274.html
Strangely enough, the current firewall is using the eepro100 driver and doing
well. I
had tried both e100 and eepro100 on the old one with similar results. Thanks for
the
info - I will add this to my list of things to check out. The current box is
doing well, but
is still temporary. For the first time in 2 weeks we are now seeing 5 minute
averages
at over 95% of our 10Mb line. I''d like to know what our peak
ip_conntrack values are
during these times - does anyone have a trick for doing this already made up? I 
thought of grep''ing /proc/slabinfo every 60 seconds or so to a file,
but maybe there is
a better way? The highest value I''ve seen is ~3000, but usage was only
around 25%
at that time.


--
Shawn Wright
I.T. Manager
Shawnigan Lake School