documentation:examples:dropping_packets_at_high_rate
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
documentation:examples:dropping_packets_at_high_rate [2020/02/07 16:29] – [Goal] olivier | documentation:examples:dropping_packets_at_high_rate [2024/02/09 09:42] (current) – [NIC level configuration] olivier | ||
---|---|---|---|
Line 12: | Line 12: | ||
- First rule is to deny a blacklist table (IP addresses) | - First rule is to deny a blacklist table (IP addresses) | ||
- Second rule is to allow all the rest | - Second rule is to allow all the rest | ||
- | - Disable the outgoing [[https:// | + | - Disable the outgoing [[https:// |
< | < | ||
Line 28: | Line 28: | ||
</ | </ | ||
==== NIC level configuration ==== | ==== NIC level configuration ==== | ||
- | (A FreeBSD 13 / head) only feature. | ||
- | Only [[https:// | + | Currently the [[https:// |
The configuration file of an IPFW-at-NIC-level is this one: | The configuration file of an IPFW-at-NIC-level is this one: | ||
Line 56: | Line 55: | ||
</ | </ | ||
- | ==== Performance | + | ==== Performance |
Hardware: | Hardware: | ||
Line 85: | Line 84: | ||
(Student' | (Student' | ||
</ | </ | ||
+ | |||
+ | On the 14Mpps of legitimate traffic, this generic (ie: supported by multi drivers) software firewall is still able to forward 12Mpps while droping 42Mpps of denied packets. | ||
===== Using Chelsio' | ===== Using Chelsio' | ||
Line 144: | Line 145: | ||
The script report an hardware dropping rate of 32Mpps: Where are the other 10Mpps ? | The script report an hardware dropping rate of 32Mpps: Where are the other 10Mpps ? | ||
- | Let's read the [[https://svnweb.freebsd.org/ | + | Let's read the [[https://cgit.freebsd.org/ |
< | < | ||
# TCAM has 8K cells; each region must start at a multiple of 128 cell. | # TCAM has 8K cells; each region must start at a multiple of 128 cell. | ||
Line 163: | Line 164: | ||
</ | </ | ||
- | To improve the TCAM performance for a filtering usage, all unused " | + | To improve the TCAM performance for a filtering usage, all unused " |
- | For that we need to download a [[https://svnweb.freebsd.org/ | + | For that we need to download a [[https://cgit.freebsd.org/ |
< | < | ||
- | # fetch -o / | + | # fetch -o / |
# sed -i "" | # sed -i "" | ||
# sed -i "" | # sed -i "" |
documentation/examples/dropping_packets_at_high_rate.1581089347.txt.gz · Last modified: 2020/02/07 16:29 by olivier