<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.E-MailFormatvorlage17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Hi,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>maybe netperf <a href="http://www.netperf.org/">http://www.netperf.org/</a> !<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>bye<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>UK<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>Von:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> users-bounces+uwe.knop=zit-bb.brandenburg.de@lists.strongswan.org [mailto:users-bounces+uwe.knop=zit-bb.brandenburg.de@lists.strongswan.org] <b>Im Auftrag von </b>Adam Tisovsky<br><b>Gesendet:</b> Donnerstag, 1. September 2011 16:47<br><b>An:</b> nima chavooshi<br><b>Cc:</b> users@lists.strongswan.org<br><b>Betreff:</b> Re: [strongSwan] Performance (in)dependent on ingress rate?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thank you Nima, <o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>your info is very valuable, as I thought that mentined behavior would be quite specific for Cisco IOS. Now I'm more encouraged to do that tests :)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>BTW, does anybody know of a tool that seeks for a max. forwarding rate using UDP (iterating the bitrate)? I have been searching for it for a long time, but unsuccesfully, so probably I'll have to write some script for Iperf. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thank you<o:p></o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Adam<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><div><p class=MsoNormal>On Thu, Sep 1, 2011 at 11:47 AM, nima chavooshi <<a href="mailto:nima0102@gmail.com">nima0102@gmail.com</a>> wrote:<o:p></o:p></p><div><p class=MsoNormal>Hi<o:p></o:p></p><div><p class=MsoNormal>I had experienced this behavior with snort in inline mode. in my test bed, I flow X mega byte on snort machine, X mg without any delay has been handle. but I increased traffic by 2 times. but snort machine only could X/2 handled!<o:p></o:p></p></div><div><p class=MsoNormal>So I think your information is true.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'>Thanks<o:p></o:p></p><div><div><div><p class=MsoNormal>On Thu, Sep 1, 2011 at 1:11 AM, Adam Tisovsky <<a href="mailto:tisovsky@gmail.com" target="_blank">tisovsky@gmail.com</a>> wrote:<o:p></o:p></p></div></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm'><div><div><div><p class=MsoNormal>Hello, <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I’m doing some benchmarks of IPsec performance on Cisco router and I have experienced the situation described bellow. My question is whether anybody has performed simillar tests on StrongSWAN and can tell how did it behave. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>When you are gradually increasing the rate of traffic to be secured (using UDP as a transport protocol) you reach the maximum possible throughput of the device. But when you continue increasing the rate of ingress traffic beyond this point, the fowarding rate of device will decrease. Example:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Max. throughput of device is 10 Mbps. If Ingress traffic rate is 10 Mbps, then forwarding rate is 10 Mbps. But when ingress rate is 20 Mbps, you get forwarding rate only 5 Mbps. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I have experienced this on Cisco 1841 router with HW accelerator DISABLED. After some investigation I foud out that more ingress traffic utilizes main CPU more by interrupts. And interrupts go on the expense of encryption process. Therefore the decrease of forwarding rate. With HW accelerator enabled this situation on does not occur, device forwards traffic at the maximum rate even if it’s overloaded by the ingress tarffic. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I didin’t find any information dealing with this, however I find it quite interesting. I’m also planning to do the tests on StrongSWAN, but it takes some time. So any information will be helpful in advance. <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thank you<o:p></o:p></p></div><div><p class=MsoNormal>Adam<o:p></o:p></p></div><div><p class=MsoNormal><span style='color:#888888'><o:p> </o:p></span></p></div><p class=MsoNormal><o:p> </o:p></p></div></div><p class=MsoNormal>_______________________________________________<br>Users mailing list<br><a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br><a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></div><p class=MsoNormal><o:p> </o:p></p></div></div></div></body></html>