Perfomance problem on MIPS
Hello all,
I have some problem with using iptables:
I work with Infineon ADM5120 SOC. It has MIPS32 4KC processor(200MHz), embedded ADM5120 switch (with 4 100Mbit interfaces).
I get embedded Linux OS work on it.
I test network bandwidth without iptables enabled in kernel - result 80Mbit/s.
When I enable Connection tracking (I need NAT) & iptables and test WITOUT ANY RULES - bandwidth was near 35-40Mbi/s.
Then I make several tests and find that most bandwidth reduction occurs when enabling Connection tracking.
It's wery upset fact. What can be done with this? Can I get version where NAT not depend on Connection tracking?
Signature · 2 lines
Best regards, art mailto:[email protected]
Zitat von art <[email protected]>:
Quoted 13 lines
Hello all,
I have some problem with using iptables:
I work with Infineon ADM5120 SOC. It has MIPS32 4KC processor(200MHz), embedded ADM5120 switch (with 4 100Mbit interfaces).
I get embedded Linux OS work on it.
I test network bandwidth without iptables enabled in kernel - result 80Mbit/s.
When I enable Connection tracking (I need NAT) & iptables and test WITOUT ANY RULES - bandwidth was near 35-40Mbi/s.
Then I make several tests and find that most bandwidth reduction occurs when enabling Connection tracking.
Quoted 2 lines
It's wery upset fact. What can be done with this? Can I get version where NAT not depend on Connection tracking?
For performance see
http://people.netfilter.org/kadlec/nftest.pdf
For NAT without conntrack use NOTRACK or disable connection tracking at all.
Regards
Andreas
Quoted 9 lines · On 06/01/2006 05:46 PM, [email protected] wrote:
Zitat von art <[email protected]>:
Quoted 2 lines
It's wery upset fact. What can be done with this? Can I get version where NAT not depend on Connection tracking?
For performance see
http://people.netfilter.org/kadlec/nftest.pdf
For NAT without conntrack use NOTRACK or disable connection tracking at all.
You cannot use the standard kernel NAT without connection tracking.
It should be possible to write some stateless mangle targets that can do simple address rewriting if that is all you need (this is the equivalent of what the fast nat in 2.2 and 2.4 kernels did).
But if you need many to 1 NAT, or complex protocols such as FTP, then you must use connection tracking.