linux-kernel - Packet time delays on multi-core systems

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100929191851.GC86786@beaver.vrungel.ru>
Date:	Wed, 29 Sep 2010 23:18:51 +0400
From:	Alexey Vlasov <renton@...ton.name>
To:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Packet time delays on multi-core systems

Hi.

I'm not sure actually that I should write here, may be I should ask in
netfilter maillist, but if is something wrong please correct me.

I've got rather large linux shared hosting, and on my new servers I
noticed some strange singularity, that this simple rule:

# iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags
FIN,SYN,RST,ACK SYN -j LOG --log-prefix "ipsec:SYN-OUTPUT "
--log-uid

gives essential time delays simply at ping from the adjacent server
on a local area network. I don't know precisely what's wrong whether the
reason is in the bad support by a kernel of new hardware, or it concerns
generally the new kernel, but now it leads to the situation that even at simple
DDOS attacks to client sites, it becomes difficult to make something, and in
general all works only worse.

It seems to me that with the increase of CPU cores' amount, it only becomes
worse and worse, and, obviously, iptables uses resources of only one processor,
which resources to it for any reason doesn't suffice.

newbox # iptables -F
otherbox # ping -c 100 newbox
...
100 packets transmitted, 100 received, 0% packet loss, time 100044ms
rtt min/avg/max/mdev = 0.133/2.637/17.172/3.736 ms

OK.

newbox # iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN
-j LOG --log-prefix "ipsec:SYN-OUTPUT " --log-uid
otherbox # ping -c 100 newbox
...
64 bytes from (newbox): icmp_seq=3 ttl=64 time=1.58 ms
64 bytes from (newbox): icmp_seq=4 ttl=64 time=98.7 ms
64 bytes from (newbox): icmp_seq=5 ttl=64 time=18.2 ms
64 bytes from (newbox): icmp_seq=6 ttl=64 time=6.13 ms
64 bytes from (newbox): icmp_seq=7 ttl=64 time=108 ms
...
64 bytes from (newbox): icmp_seq=55 ttl=64 time=2.30 ms
64 bytes from (newbox): icmp_seq=56 ttl=64 time=59.9 ms
64 bytes from (newbox): icmp_seq=57 ttl=64 time=0.155 ms
...
64 bytes from (newbox): icmp_seq=61 ttl=64 time=13.4 ms
64 bytes from (newbox): icmp_seq=62 ttl=64 time=55.0 ms
64 bytes from (newbox): icmp_seq=63 ttl=64 time=0.233 ms
...
100 packets transmitted, 100 received, 0% packet loss, time 99957ms
rtt min/avg/max/mdev = 0.111/7.519/108.061/18.478 ms

newbox # iptables -L -v -n
Chain INPUT (policy ACCEPT 346K packets, 213M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 296K packets, 290M bytes)
 pkts bytes target     prot opt in     out     source               destination
  234 14040 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0    
tcp dpt:80 flags:0x17/0x02 LOG flags 8 level 4 prefix `ipsec:SYN-OUTPUT- '

My old server: Intel SR1500, Xeon 5430, kernel 2.6.24 - 2.6.28
Newbox: SR1620UR, 5650, kernel 2.6.32

Thanks in advance.

-- 
BRGDS. Alexey Vlasov.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/