Losing connections/performance with PF turned on

[Max Laier]

On Thursday 05 July 2007, Pat Maddox wrote:
> We're doing some stress testing on our server, and noticed that when
> we turn PF on, we lose connections and have a drastic reduction in
> performance.

My guess would be that you are exhausting the ephemeral port range of the 
querying box.  pf has quite strict (maybe too strict) enforcement of the 
TIME_WAIT silence periode.  There are several ways to work around this 
(which only is a problem while benchmarking):
 - use shorter state timeouts. "tcp.closed" in particular
 - increase the ephemeral port range on the query node
	net.inet.ip.portrange.[hi]{last,first}
   see ip(4) for details.
 - Use a more realistic benchmark (i.e. coming from more than one IP)

In order to verify that this is indeed the problem look for state-mismatch 
counter increases in the "pfctl -si" output or debug messages on the 
console while running with "pfctl -xm".

> We used SIEGE for 120 seconds, 50 connections, on req/conn
>
> Firewall On:
>
> Num Users: 50
> Availability: 97.23 %
> Transaction rate: 58.02 trans/sec
> Concurrency: 3.80
> Successful: 6994
> Failed: 198
> Longest Req: 9.06s
>
> Firewall Off:
>
> Num Users: 50
> Availability: 100 %
> Transaction rate: 94.62 trans/sec
> Concurrency: 1.76
> Successful: 11342
> Failed: 0
> Longest Req: 0.51s
...

-- 
FreeBSD Status reports due: 07/07/07 :-)

/"\  Best regards,                      | mlaier at freebsd.org
\ /  Max Laier                          | ICQ #67774661
 X   http://pf4freebsd.love2party.net/  | mlaier at EFnet
/ \  ASCII Ribbon Campaign              | Against HTML Mail and News
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: This is a digitally signed message part.
Url : http://lists.freebsd.org/pipermail/freebsd-pf/attachments/20070705/4272cb02/attachment.pgp