netfilter benchmarks on two gigabit ethernet cards

Hello

do you know any benchmarks showing packet per seconds filtering power of netfilter running on X86 platforms with two gigabit cards? Same question for ARM based platforms.

I know that this is a silly question cos it is heavily dependent on both the hardware platform and the filtering rules, but I really need to know the numbers ( or I'll do the tests by myself ).

Thanks for netfilter.

Zef'

I dont have any published numbers but what I found was that it depended on multiple factors:

PCI-Extreme vs PCI-X vs PCI
PCI 32bit vs 64 bit card
switch vendor
card vendor and chipset (intel vs broadcom etc) Kernel version
2.4.9 vs 2.4.20 vs 2.4.24 gave different numbers
vendor kernels also widely different
2.6.0 vs 2.6.9 also gave different numbers
IA32 vs AMD-64

We were able to get about 89% sustained wire-rate (1.78 Gbit over 2Gbit throughput) on a 1.5 Ghz system with 133 Mhz PCI-X E1000 cards. The AMD64 system we were spec'ing out would have been useful for 10Gbit traffic.

Things that killed our testing were dealing with small and large packets on the wire at the same time. The testing guys were used to testing gbit switches and throwing millions of small packets in with the large packets and seeing what got through. The netfilter with 2.4.24 kernel didnt do too well (trhoughput fell to 60%) but I didnt get time to try and tune beyond out of the box.

Stephen J Smoogen.
CSIRT/Linux System Administrator

Hi,

http://people.netfilter.org/kadlec/nftest.pdf summaries the results of such tests we performed at the beginning of this year.

Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics

          H-1525 Budapest 114, POB. 49, Hungary

Waooh, very nice results!
Thanks also to Stephen for his answer.

Do you think that something like a Dell PowerEdge* *SC1425 would be a good low cost gigabit firewall?

Zef'