How to measure/profile ruleset performance?
Hi,
How can I measure the performance of particular nftables rules/chains/tables with idea to optimize the bottlenecks?
Currently, I am trying to do this by commenting/uncommenting sections of the ruleset and running iperf3. However, this seems quite inaccurate, inconsistent and time-consuming.
iperf3 checks only link throughput. To evaluate firewall performance you would need to generate high packet rate.
Quoted 9 lines · William N.
Hi,
How can I measure the performance of particular nftables rules/chains/tables with idea to optimize the bottlenecks?
Currently, I am trying to do this by commenting/uncommenting sections of the ruleset and running iperf3. However, this seems quite inaccurate, inconsistent and time-consuming.
Signature · 1 line
Send unsolicited bulk mail to [email protected]
Quoted 2 lines · On Fri, 19 Apr 2024 16:06:14 +0000 Serhii wrote:
To evaluate firewall performance you would need to generate high packet rate.
How to do that?
And how will I know how individual rules perform?
I am not aware of any software-appliances or solutions to perform per-rule firewall performance evaluation, however there are a few hardware traffic generators that are able to squeze packets on a line rate speed. As for software frameworks, you might be interested in DPDK.
Quoted 8 lines · William N.
Quoted 2 lines · On Fri, 19 Apr 2024 16:06:14 +0000 Serhii wrote:
To evaluate firewall performance you would need to generate high packet rate.
How to do that?
And how will I know how individual rules perform?
Signature · 1 line
Send unsolicited bulk mail to [email protected]
What do you mean by:
Quoted 3 lines · On Fri, 19 Apr 2024 16:30:45 +0000 Serhii wrote:
to squeze packets on a line rate speed.
to generate high packet rate.
Is that possible with Linux software tools?