IPsec's use of processors

[Patrick Lamaizière]

Le Fri, 14 Nov 2008 13:37:58 +0200,
"Riaan Kruger" <riaank at gmail.com> a écrit :

> I would like to know how IPsec makes use of a multi processor machine?
> 
> I have gateway (FreeBSD 7.0) with four SAs configured. When testing
> throughput through the configured SAs, I see (with systat) that only
> one cpu works really hard (+-10% idle min), two others work a bit
> (+-70% idle min) and the fourth CPU does pretty much nothing.
> 
> Is this normal, shouldn't at least the two cpus work hard because of
> the high throughput?

I guess that's because the cryptographic requests are dispatched
and done by two kernel threads. The thread 'crypto' dispatches and
processes the requests, the thread 'crypto-returns' returns the results.

You can see these kernel threads with top S H

Regards.