Re: SYN floods and LVS-NAT CPU Load

To: lvs-users@xxxxxxxxxxxxxxxxxxxxxx
Subject: Re: SYN floods and LVS-NAT CPU Load
From: Fabrice <fabrice@xxxxxxxxxx>
Date: Mon, 10 Dec 2001 20:45:54 +0100
Hello Julian,

Thanks for your answers. I still need a bit of explanations on the
Fast Ethernet network :)

> I tought that FastEthernet was limited to about 8000 packets per seconds.
> How is it possible,


        Now check with 60-byte SYN packets. Then with X-byte UDP packets
where X is your average packet size

For example, you mean that you can put 25 "60 bytes SYN packets"
into one Ethernet frame? So you have about 8000*25 = 200'000 SYN
packets/s? Are you sure? :)
Each Ethernet frame has already the source and destination MAC
address, and I don't think you can put multiple layer 3 packets in one
layer 2 packet.

> even with 2 NICs, to reach 110'000 SYN packets per seconds? Is the testlvs
> program run
> directly on the LVS box?

        No, many client hosts runing testlvs. One 600MHz may be can
generate 40-50K packets/sec. Run it on 2-3 client hosts. The RS only
drops after accounting.

I have only 1 client (PIII 500, 128MB RAM), but I can't send more than
about 2000 SYN packets/s, with peaks at 8000 (reported on the director
Can the syncookie mechanism "slow down" the connection reception

> How to bypass this limitation? Gigabit Ethernet cards/network?

My network is already at 100Mbps :)

        This load is difficult to measure. You can run the following
commands in 2 different terminals on the director, at the same time:

1> vmstat 1
2> vmstat 10

        If they show big difference, then you are near the limits

I'll try that tomorrow.

Thanks for all,

Fabrice Bucher

<Prev in Thread] Current Thread [Next in Thread>