netdev - RE: [IPsec] CPU usage for IPSec in Linux 2.6.38

Open Source and information security mailing list archives

Message-ID: <A2354B6A9F807641B21EEABD666ECEEA02596D9C@XMB-BGL-416.cisco.com>
Date:	Tue, 10 Jan 2012 20:30:08 +0530
From:	"Naveen B N (nbn)" <nbn@...co.com>
To:	"John Lowry" <jlowry@....com>
Cc:	<netdev@...r.kernel.org>
Subject: RE: [IPsec] CPU usage for IPSec in Linux 2.6.38

I think the issue is when adding an entry to SPD 
Database which already contains 4000 entries, because 
The entries have to be checked before adding the 
New entry.

Regards
Naveen  

-----Original Message-----
From: John Lowry [mailto:jlowry@....com] 
Sent: Tuesday, January 10, 2012 8:25 PM
To: Naveen B N (nbn)
Subject: Re: [IPsec] CPU usage for IPSec in Linux 2.6.38

The only time we had troubles like this was with
a Dell 1U that had rotten drivers.  Upgrading to
different kernel and updated drivers fixed the problem.

On Jan 10, 2012, at 8:48 AM, Naveen B N (nbn) wrote:

> Hi All,
> I am using linux 2.6.36 kernel and trying to add 6000 Ikev2/ipsec
> tunnels 
> at 20 Ikev2 messages per second , I am using netlink socket which is
set
> to 
> NON_BLOCKING and i am sending XFRM SPD added for every successful AUTH
> message received.
> 
> But the problem is after the 4000 tunnels are established, CPU usage
> goes 
> to > 90%, which will likely cause dropping of few AUTH response from
> responder.
> 
> NOTE:
> But when I disabled adding SPD messaged via netlink sockets using xfrm
> messages,
> I am able to complete 6000 ikev2 SA negotiation successfully.
> 
> So the problem i am seeing is when sending XFRM netlink message >
4000.
> 
> Any solutions are or analysis different then the above is appreciated.
> 
> 
> Thanks and Regards
> Naveen 
> _______________________________________________
> IPsec mailing list
> IPsec@...f.org
> https://www.ietf.org/mailman/listinfo/ipsec

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives