Large scale NAT problems

[Luigi Rizzo]

On Tue, Dec 16, 2003 at 04:39:42AM -0800, Julian Elischer wrote:
> did you try natd?
> (for comparison)

i guess ipnat is in kernel, whereas natd is in userland,
and furthermore natd's session handling is just not up
to the job (small hash tables, huge session expire times...)

	cheers
	luigi

> On Tue, 16 Dec 2003, Andriy Korud wrote:
> 
> > Hi,
> > I'm tring to make NAT on FreeBSD box for 2500 clients on 35Mbit uplink.
> > Box is Xeon 2.8GHz, 1G RAM, 2xIntel PRO/1000 (em) adapters.
> > FreeBSD 4.9-STABLE, kernel is configured for single processor (HT not used),
> > with DEVICE_POLLING and HZ=2000, LARGE_NAT defined.
> > Nat was done using ipnat, no additional filtering.
> > 
> > The problem is that when traffic grows to 10Mbit and number of active NAT
> > sessions reach 70000, CPU usage exponentialy grows and system spends all CPU
> > time in interrupts handling. 
> > The system become completely unreponsible and unsable and only hard reset is the
> > solution.
> > 
> > And worse thing is that Linux on Cel/800 with SOHO cards do that NATing with 5%
> > CPU load without any problem :-(.
> > 
> > Maybe I shoud try natd? May this help?
> > Any suggestions?
> > 
> > thanks in advance,
> > 
> > Andriy Korud
> > 
> > 
> > _______________________________________________
> > freebsd-net at freebsd.org mailing list
> > http://lists.freebsd.org/mailman/listinfo/freebsd-net
> > To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
> > 
> 
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"