netdev - Re: ipsec performance

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f5327b860912291531u31bf0719t4c031fa14bfe7003@mail.gmail.com>
Date:	Wed, 30 Dec 2009 00:31:08 +0100
From:	Andreas Schuldei <schuldei@...tify.com>
To:	Abhijit Karmarkar <awk@...gle.com>
Cc:	netdev@...r.kernel.org
Subject: Re: ipsec performance

On Tue, Dec 29, 2009 at 11:55 PM, Abhijit Karmarkar <awk@...gle.com> wrote:
> On Tue, Dec 29, 2009 at 1:09 PM, Andreas Schuldei <schuldei@...tify.com> wrote:
>> hi!
>>
>> i experience performance issues with ipsec transport mode with debian
>> lenny and strongswan, on a stock debian kernel 2.6.26-2-amd64.
>>
>> the goal is to set up a full mash of several hundred hosts, talking
>> ipsec with each other, in order to be able to skip firewalls and to be
>> able to let the hosts be spread out over several sites in a
>> transparent fashion.
>>
>> regardless of the cipher (i tried aes and blowfish) the bandwidth
>> maxes out at about 0.5-0.25 of the expected (unencrypted) value,
>> without hitting obvious bottlenecks like cpu, disk, or ram.
>
> you may want try Steffen Klassert's parallel crypto patches (nice work!):
>
>  http://marc.info/?l=linux-kernel&m=126155699817914&w=2
>
> the numbers are impressive. i plan to try them sometime this (or next week).
>
> yes, on the current kernels, the ipsec throughput numbers are around
> 50% of the non-ipsec case. for me.

i have an 8core xeon machine 2.5GHz machine and my throughput of
39Mbyte/s correlates nicely with Steffens 325Mbit/s when i use AES.
when i switch to blowfish the throuput decreases to 27.5Mbyte/s. the
time the cpu spends in kernel code decreases, too, to ~5% (give or
take a coconut). the machine seems idle, almost. where is the
bottleneck? what needs parallelization? (i read steffens mail but i
didnt understand his explanation. could you explain it in laymens
terms?) what i find funny is that the apache process serving the data
uses between 20-95%cpu. how come?

i dont intent do have vpn gateways.  I want every machine to encrypt
its own network traffic. doubling the performance (as steffens patch
seems to do) would help (in the AES case, not for blowfish.). i would
want to actually deploy the stuff soon, though, and i will have a hard
time selling a patch and a homebuild kernel to my colleges.

>> how can i inspect window size, fragmentation etc? are there useful
>> files in /proc or /sys or enlightening ip commands?

is there a way to do this?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html