NetFilter
[Top] [All Lists]

Re: How to measure CPU usage of netfilter

To: netfilter@lists.netfilter.org
Subject: Re: How to measure CPU usage of netfilter
From: Mike Williams <mike@v6.gaima.co.uk>
Date: Tue, 21 Nov 2006 01:10:11 +0000
Delivered-to: sp-com-lists@consult.net
Delivered-to: netfilter-list1@securepoint.com
In-reply-to: <1164069640.4057.31.camel@mfarooq-1.tango-networks.com>
List-archive: </pipermail/netfilter>
List-help: <mailto:netfilter-request@lists.netfilter.org?subject=help>
List-id: General discussion and user questions <netfilter.lists.netfilter.org>
List-post: <mailto:netfilter@lists.netfilter.org>
List-subscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=subscribe>
List-unsubscribe: <https://lists.netfilter.org/mailman/listinfo/netfilter>, <mailto:netfilter-request@lists.netfilter.org?subject=unsubscribe>
References: <1164069640.4057.31.camel@mfarooq-1.tango-networks.com>
Sender: netfilter-bounces@lists.netfilter.org
User-agent: KMail/1.9.4
On Tuesday 21 November 2006 00:40, Mohammad Farooq wrote:
> Hi Guys,
>
>   I have about 1000 rules in the iptables. All these rules just forward
> the incoming traffic to other systems. I am trying to measure CPU usage
> of the netfilter. I tried to measure with top command but some how it
> always shows that CPU is 95% idle. I am not sure if top is the
> appropriate command to measure CPU usage of the netfilter. Since all the
> filtering is happening inside the kernel there should be some other command
> to measure kernel's CPU usage. I would appreciate if someone can point to
> the right direction. Thanks.

While I don't know if there is a "right way", 5% is probably about right, even 
taking into account the top overhead.
I have a fairly complex iptable setup on a PIII 800 pushing over 40Mbps of 
mostly web traffic, NATting it to a varity of webservers on 2 different 
physical networks. Conntrack gets upto and over 60000. The busiest webserver 
handles in excess of 300 requests a second coming through the firewall.
We've just passed peak usage and the CPU usage averaged a little over 20% over 
the period, according to the nice rrdtool graphs cacti generates for me from 
snmp.

I'm also using ulogd to log dropped packets. CPU usage can average ~40% higher 
if that gets too large, or fills the disk (which it's done a couple times). I 
should turn it off really...

-- 
Mike Williams

-- 
Mike Williams


<Prev in Thread] Current Thread [Next in Thread>