documentation:examples:dropping_packets_at_high_rate
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
documentation:examples:dropping_packets_at_high_rate [2020/02/07 16:15] – [Using Chelsio's TCAM firewall] olivier | documentation:examples:dropping_packets_at_high_rate [2024/02/09 09:42] (current) – [NIC level configuration] olivier | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Dropping packets at high rate ====== | ====== Dropping packets at high rate ====== | ||
- | ===== Goal ===== | + | ===== Objective |
{{: | {{: | ||
Line 12: | Line 12: | ||
- First rule is to deny a blacklist table (IP addresses) | - First rule is to deny a blacklist table (IP addresses) | ||
- Second rule is to allow all the rest | - Second rule is to allow all the rest | ||
- | - Disable the outgoing [[https:// | + | - Disable the outgoing [[https:// |
< | < | ||
Line 28: | Line 28: | ||
</ | </ | ||
==== NIC level configuration ==== | ==== NIC level configuration ==== | ||
- | (A FreeBSD 13 / head) only feature. | ||
- | Only [[https:// | + | Currently the [[https:// |
The configuration file of an IPFW-at-NIC-level is this one: | The configuration file of an IPFW-at-NIC-level is this one: | ||
Line 56: | Line 55: | ||
</ | </ | ||
- | ==== Performance | + | ==== Performance |
Hardware: | Hardware: | ||
Line 85: | Line 84: | ||
(Student' | (Student' | ||
</ | </ | ||
+ | |||
+ | On the 14Mpps of legitimate traffic, this generic (ie: supported by multi drivers) software firewall is still able to forward 12Mpps while droping 42Mpps of denied packets. | ||
===== Using Chelsio' | ===== Using Chelsio' | ||
Line 144: | Line 145: | ||
The script report an hardware dropping rate of 32Mpps: Where are the other 10Mpps ? | The script report an hardware dropping rate of 32Mpps: Where are the other 10Mpps ? | ||
- | Let's read the [[https://svnweb.freebsd.org/ | + | Let's read the [[https://cgit.freebsd.org/ |
< | < | ||
# TCAM has 8K cells; each region must start at a multiple of 128 cell. | # TCAM has 8K cells; each region must start at a multiple of 128 cell. | ||
Line 163: | Line 164: | ||
</ | </ | ||
- | To improve the TCAM performance for a filtering usage, all unused " | + | To improve the TCAM performance for a filtering usage, all unused " |
- | + | For that we need to download a [[https://cgit.freebsd.org/ | |
- | For that we need to download a [[https://svnweb.freebsd.org/ | + | |
< | < | ||
- | # fetch -o / | + | # fetch -o / |
# sed -i "" | # sed -i "" | ||
- | # sed -i "" | + | # sed -i "" |
# sed -i "" | # sed -i "" | ||
# sed -i "" | # sed -i "" | ||
Line 183: | Line 183: | ||
12 | 12 | ||
</ | </ | ||
- | We confirm that server|hash are at 0, | + | We confirm that regions |
Now the packet drop rate by the TCAM firewall match the generator' | Now the packet drop rate by the TCAM firewall match the generator' | ||
Line 199: | Line 199: | ||
</ | </ | ||
- | And the firewall able to forward all packets without being too busy in the same time: | + | And the firewall |
< | < | ||
[root@firewall]~# | [root@firewall]~# | ||
Line 211: | Line 211: | ||
| | ||
| | ||
+ | |||
[root@firewall]~# | [root@firewall]~# | ||
| |
documentation/examples/dropping_packets_at_high_rate.1581088552.txt.gz · Last modified: 2020/02/07 16:15 by olivier