Performance degradation with pakon or device discovery


#1

Hi

I have a Turris Omnia :
Turris Omnia - rtrom01
Turris OS version 3.11.2
Kernel version 4.4.169-7bc33afbb1b35f5830b2b1b42c9cd8a0-2

There is a significant performance degradation when i install pakon or device discovery (so everything that is somehow connected to suricata).

The config on the omnia is very simple…it’s basically a NAT box…

So without pakon and/or device detection i get a throughput of cca 940Mb/s (TCP L4) that is the max that the interface can handle.

But with pakon enabled or device discovery I get speeds around 600Mb/s (100Mb/s more or less it fluctuates a lot).

is this normal ? I know that suricata is cpu intensive…but cca 30% is quite a lot


#2

Can reproduce this as well, have logged this bug


#3

THX ! @tonyquan,
I’m really curious if it can be fixed or is the CPU just to weak to handle suricata at wirespeed…


#4

Soooooo…any news about this ?


#5

Any improvement here ?


#6

This is not a defect but the property. Do you realistically use 940Mb/s? Or it si throughput ? What do you usually download and upload?


#7

Yeah…it maybe is a “property” but since I couldn’t find anywhere a description of this “property” and it practically reduces max throughput that is achievable in NAT by 40%, I consider it a problem !

If there would be some kind of statement or comment somwhere that by enabling suricata this happens, then it would be a “property”, and a Known fact and I wouldn’t consider it as a problem, but like I said I didn’t find any documentation on this (at that point when the firs post was written)

As for our throughput…yeah at peak hours our throuhput through the turris is cca 800 Mb/s, which is not achievable with pakon turned on .


#8

Filtration of all data streams and its analysis must have some overhead of CPU performance. It’s not free (pay free :-)). If you are basping not the speed of the Pakon you uninstall

Similarly, FTP and SFTP do not have the same transfer speed. You also want to solve this ?


#9

Hi JardaB

thanks for feedback, yes I have also read about experimental device detection model can cause this, and indeed i have also installed it, however, I found it is a nice feature, that I didnt want to miss, so in the end I solved the problem by configuring the pakon custom version of suricata so that I whitelisted NFS traffic and installed device detection modul again.


#10

Dude…did you read the whole thread ? Post nr.3 ? I just wanted to know if it is something you can fix/ tweak or if the CPU is to weak to handle suricata at wirespeed…

And what has FTP and SFTP to do with it ??? There are also a ton of other factors that make the speed difference between those two protocols besides the CPU (if that was your point)…

So in the end…what you wanted to say is that the CPU in the turris is too weak to handle suricata at wire speed…is that correct ?


#11

there are numerous stong indications for it.


#12

With which other routers you compare CPU and mem performance ?


#13

It should be fairly simple to monitor CPU usage during that stress-testing. I expect faster CPU would just solve it, but (1) it’s better to confirm CPU is really loaded, and (2) there might be other ways around the limitation.


#14

By me max 20% CPU “normal operation” (peak 30%) (Surikaca 2 proceses together max 6% )

And via iperf to LAN about 30%

root@Omnia:~# iperf -c 192.168.2.1 -m -i 5 -t 30 -r
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
------------------------------------------------------------
Client connecting to 192.168.2.1, TCP port 5001
TCP window size: 2.50 MByte (default)
------------------------------------------------------------
[  5] local 192.168.2.1 port 52496 connected with 192.168.2.1 port 5001
[  4] local 192.168.2.1 port 5001 connected with 192.168.2.1 port 52496
[ ID] Interval       Transfer     Bandwidth
[  5]  0.0- 5.0 sec   504 MBytes   845 Mbits/sec
[  4]  0.0- 5.0 sec   504 MBytes   845 Mbits/sec
[  5]  5.0-10.0 sec   514 MBytes   863 Mbits/sec
[  4]  5.0-10.0 sec   514 MBytes   863 Mbits/sec
[  5] 10.0-15.0 sec   514 MBytes   863 Mbits/sec
[  4] 10.0-15.0 sec   514 MBytes   863 Mbits/sec
[  5] 15.0-20.0 sec   511 MBytes   858 Mbits/sec
[  4] 15.0-20.0 sec   511 MBytes   858 Mbits/sec
[  5] 20.0-25.0 sec   517 MBytes   867 Mbits/sec
[  4] 20.0-25.0 sec   517 MBytes   868 Mbits/sec
[  5] 25.0-30.0 sec   516 MBytes   866 Mbits/sec
[  5]  0.0-30.0 sec  3.01 GBytes   860 Mbits/sec
[  5] MSS size 65483 bytes (MTU 65523 bytes, unknown interface)
[  4] 25.0-30.0 sec   516 MBytes   866 Mbits/sec
[  4]  0.0-30.0 sec  3.01 GBytes   860 Mbits/sec
[  4] MSS size 21888 bytes (MTU 21928 bytes, unknown interface)
root@Omnia:~#