On Tuesday 21 November 2006 00:40, Mohammad Farooq wrote:
> Hi Guys,
>
> I have about 1000 rules in the iptables. All these rules just forward
> the incoming traffic to other systems. I am trying to measure CPU usage
> of the netfilter. I tried to measure with top command but some how it
> always shows that CPU is 95% idle. I am not sure if top is the
> appropriate command to measure CPU usage of the netfilter. Since all the
> filtering is happening inside the kernel there should be some other command
> to measure kernel's CPU usage. I would appreciate if someone can point to
> the right direction. Thanks.
While I don't know if there is a "right way", 5% is probably about right, even
taking into account the top overhead.
I have a fairly complex iptable setup on a PIII 800 pushing over 40Mbps of
mostly web traffic, NATting it to a varity of webservers on 2 different
physical networks. Conntrack gets upto and over 60000. The busiest webserver
handles in excess of 300 requests a second coming through the firewall.
We've just passed peak usage and the CPU usage averaged a little over 20% over
the period, according to the nice rrdtool graphs cacti generates for me from
snmp.
I'm also using ulogd to log dropped packets. CPU usage can average ~40% higher
if that gets too large, or fills the disk (which it's done a couple times). I
should turn it off really...
--
Mike Williams
--
Mike Williams
|