Re: Poor IPSec performance with 2.6 kernels

[Tom Sightler <ttsig@tuxyturvy.com>]

> 	In which direction did you take these benchmarks, inbound to the
> Linux box, outbound from the Linux box, or both?  If both, is
> there a difference between inbound and outbound performance?  What
> private key algorithm are you configuring (aes, des, serpent)?  How
> is your DSL connected (via ethernet, via USB, such as with SpeedStream)?
> What kind of CPU are you using (probably doesn't matter, even if you're
> using a 16MHz 386, but it would help in reproducing your problem to
> know what the benchmarks should look like on a different system).

Unfortunately my DSL service is ADSL and my uplink is only 256Kbps which
gives me about 25-30KB/s on a typical, non-IPsec FTP upload.  Both SFS
and in-kernel IPsec give approximately the same outbound speed over this
limited link, roughly 20KB/s, which seems about right to me.

I'm using 3des for the encryption algorithm.

DSL is connected via ethernet.

CPU is an AMD K6/2 333Mhz.

I also just thought about the fact that I could test my laptop to see if
this is a CPU related issue.  It's running the same basic kernel but of
course with options for laptop devices enabled and compiled for i686,
etc.  It's a much faster machine, a PIII/1.13Ghz system.  If I still get
roughly the same performance then we can probably safely assume it's not
a CPU constraint.  I'll test the tonight.

I'm also going to try and pull some TCP dump data to see if it gives me
any hints.

Anything else I can answer.

Later,
Tom