Steep drop in throughput using NFQUEUE

[Hariharan Thantry <thantry@xxxxxxxxx>]

Hi folks,

I'm trying to setup an IPS infrastructure using Suricata. My setup is
the following:

Machine A (Client): Regular Desktop with one dual ported 10G 82599 NICs
Machine B (Bridge, hosting Suricata): An entry level Xeon with 2 dual
ported 10G 82599 NICs
http://www.newegg.com/Product/Product.aspx?Item=N82E16813131725
Machine C (Server): Regular Desktop with one dual ported 10G 82599 NIC

Note that the machine hosting Suricata is a ___pure___ bridge (no IP address)

The forwarding performance of the bridge with the single 10G
connection active is ~9.5 Gbps (almost line rate), while with both 10G
connections active is ~ 13 Gbps (no tuning).

While trying out Suricata as an IPS in this setup, I noticed a steep
drop in the forwarding rate. The single 10G connection speeds dropped
to ~ 400 Kbps.

The Suricata machine has the following rule setup:

$ sudo iptables -A FORWARD -j NFQUEUE --queue-num 0

To see if the drop in the rate was independent of the Suricata stack
or not, I ran the example program from here:

http://www.netfilter.org/projects/libnetfilter_queue/doxygen/nfqnl__test_8c_source.html

and noticed that the speeds are the same as above (~400 Kbps). With
COPY_META, the speeds increased to ~ 2Mbps.

Is this steep drop expected? Any suggestions on what I could be
missing, or how could I optimize it?

Interestingly, using ebtables, and its user space handler

$sudo ebtables -A FORWARD --ulog-nlgroup 1
http://ebtables.sourceforge.net/examples/basic.html#ex_ulog
kept up with the line rate, which was rather surprising, because even
that handler involves a copy to user space.

Any suggestions would be appreciated.

Thanks,
Hari
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html