netdev - Linux router kernel configuration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 23 Aug 2016 23:28:19 +0300
From:   Anton Danilov <littlesmilingcloud@...il.com>
To:     netdev@...r.kernel.org
Subject: Linux router kernel configuration

Hello everyone.

I'm working in a small ISP company, and we're using x86 servers under debian as core and border routers.

The pair of core routers (active-backup redundancy scheme) are the dual-socket servers with Xeon E5-2637 v2 CPUs and one 82599EB dual-port 10G NIC. Tasks of these routers: traffic shaping (HTB+pfifo with u32 hashing classifier), content filtering (ipset + nfqueue + suricata) and some blocking of access with ipset address sets. Average duplex traffic is couple of gigabits per second / several hundreds of kpps. Currently we're using the custom configurated 3.10 kernel on these servers. 

I have several questions about kernel configuration in which I'm stuck or doubt:
1. Kernel version. What is the kernel better for these tasks at now? I'm think about usage of latest LTS kernel (4.4).
1. Timers subsystem: periodic ticks / idle dynticks / full dynticks. Are there some recomendations? Currently I'm using periodic ticks with 1000HZ frequency. Maybe is there better choice?
2. Preemption model. I'm using the no forced preemption on routers.
3. Power management. Should I disable the processor power management features in kernel config or use the kernel cmd line boot options like processor.max_cstate = 0 and intel_idle.max_cstate = 0?
4. Hyper-threading usage. I've disabled it in the bios to avoid a unefficient cache usage. But maybe someone have opposite view on this feature.

Thanks for your attention and advices.

---

With best regards
Anton Danilov mailto://littlesmilingcloud@...il.com