FreeBSD 7, bridge, PF and syn flood = very bad performance

[Max Laier]

On Saturday 26 January 2008, Stefan Lambrev wrote:
> Max Laier wrote:
> > On Friday 25 January 2008, Stefan Lambrev wrote:
> >> Greetings,
> >>
> >> Does anyone try to see PF with "keep state" in action when under syn
> >> flood attack?
> >> I tried to get some help in freebsd-pf@, because the test firewall,
> >> that I build hardly can handle 2-5MB/s syn flood.
> >> Unfortunately I do not saw useful advice.
> >> The problem is that a quad core bridge firewall running freebsd 7
> >> amd64 with PF is near useless and can't handle "small" SYN ddos.
> >>
> >> Here is the schema that I'm testing:
> >> web server (freebsd) - freebsd (bridged interfaces) - gigabit switch
> >> - clients + flooders
> >> In this configuration ~25MB/s syn flood (and I think this limit is
> >> because of my switch) is not a problem and the web server responds
> >> without a problem.
> >> With this configuration netperf -l 610 -p 10303 -H 10.3.3.1 shows
> >> 116MB/s stable speed , so I guess there are no problems with cables,
> >> hardware and etc :)
> >>
> >> But when I start pf (see below the config file) the traffic drops to
> >> 2-3MB/s and the web server is hardly accessible.
> >> It seems that device polling helps a lot in this situation, and at
> >> least the bridge firewall is accessible. Without "polling" the
> >> firewall is so heavily loaded
> >> that even commands like "date" take few seconds to finish, with 2
> >> cores at ~100% idle at same time.
> >>
> >> I have "flat profiles" from hwpmc, and I think it indicates a
> >> problem:
> >>
> >> (bridge, pf enabled, polling enabled, sched_ule - I have profiles
> >> and for other combinations too if needed)
> >>   %   cumulative   self              self     total
> >>  time   seconds   seconds    calls  ms/call  ms/call  name
> >>  24.0  268416.00 268416.00        0  100.00%          
> >> _mtx_lock_sleep
> >
> > Can you build a kernel with LOCK_PROFILING and try to figure out
> > which lock is causing this?
>
> Yes I can build kernel with LOCK_PROFILING.
> But I have no idea how to use it :)
> Can you point me to some documentation?

man LOCK_PROFILING

basically:
# sysctl debug.lock.prof.enable=1 && sleep 60 && \
  sysctl debug.lock.prof.enable=0 && \
  sysctl debug.lock.prof.stats > log

while under attack to sample one minute of lock statistics.

-- 
/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part.
Url : http://lists.freebsd.org/pipermail/freebsd-current/attachments/20080126/b954ec03/attachment.pgp