35-40% performance drop releng9 vs releng10 openvpn
Mike Tancsa
mike at sentex.net
Thu Mar 19 01:36:32 UTC 2015
And compiling 1.0.1l on RELENG_9 shows the same performance profile on
RELENG_10. Smaller packets are slower, larger are faster
16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
20245.49k 21646.52k 22179.87k 55431.85k 55981.40k R10
34178.77k 35559.29k 36305.70k 36481.34k 36495.49k R9
20278.40k 21642.28k 22170.71k 56873.98k 57387.69k R9Port
But for my application, I still get better speeds on RELENG_9, even when
using the same version of openssl across RELENGs.
I do the test with the 3 FreeBSD boxes
server1 ---- apu ---- server2
server1 is connected to the apu with openvpn.
I then usr /usr/src/tools/tools/netrate/netblast
to send across the openvpn tunnel to server2
on RELENG9 I get 83-85Mb/s
on RELENG10 61Mb/s
Using polarSSL does not make much of a difference either way. Its
perhaps 1Mb slower on both, so 82-83 vs 83-85 on R9 and 59-60Mbs vs
61-20Mb/s on RELENG10.
But, on RELENG_9, if I install openssl from the ports, and compile
openvpn and link against it, I get 85-87Mb/s of throughput on RELENG_9.
So while there are speed differences between the versions of openssl,
it doesnt seem to matter in the OpenVPN case, as its the base OS that
makes the difference since both versions of OpenSSL on RELENG9 give
similar performance in my openvpn test
On RELENG_9, the dtrace command I use on 10 does not seem to work
0{alix_APU1c4}# dtrace -x stackframes=100 -n 'profile-997 /arg0/ {
@[stack()] = count(); } tick-60s { exit(0); }' -o out.kern_stacks9
dtrace: invalid probe specifier profile-997 /arg0/ { @[stack()] =
count(); } tick-60s { exit(0); }: "/usr/lib/dtrace/regs_x86.d", line 2:
type redeclared: struct devinfo
1{alix_APU1c4}#
---Mike
On 3/18/2015 7:58 PM, Mike Tancsa wrote:
> On 3/18/2015 6:40 PM, Matt Smith wrote:
>> Isn't OpenSSL in the base on releng9 the 0.9.8 version whereas in
>> releng10 it's the 1.0.1 version? This could make a significant
>> difference. I've heard rumours before that the newer version is a lot
>> slower but I've never had cause to believe it.
>>
>
> openssl speed aes-128-cbc
>
> 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
> 20245.49k 21646.52k 22179.87k 55431.85k 55981.40k R10
> 34178.77k 35559.29k 36305.70k 36481.34k 36495.49k R9
>
> R9 OpenSSL 0.9.8zd-freebsd 8 Jan 2015
> R10 OpenSSL 1.0.1l-freebsd 15 Jan 2015
>
> Interesting, its mixed based on size
>
> ---Mike
>
>
>
> _______________________________________________
> freebsd-stable at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-stable
> To unsubscribe, send any mail to "freebsd-stable-unsubscribe at freebsd.org"
>
--
-------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike at sentex.net
Providing Internet services since 1994 www.sentex.net
Cambridge, Ontario Canada http://www.tancsa.com/
-------------- next part --------------
RELENG_10
0(alix_APU1c4)# openssl speed aes-128-cbc
Doing aes-128 cbc for 3s on 16 size blocks: 3884998 aes-128 cbc's in 3.07s
Doing aes-128 cbc for 3s on 64 size blocks: 1064886 aes-128 cbc's in 3.15s
Doing aes-128 cbc for 3s on 256 size blocks: 261951 aes-128 cbc's in 3.02s
Doing aes-128 cbc for 3s on 1024 size blocks: 162398 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 20501 aes-128 cbc's in 3.00s
OpenSSL 1.0.1l-freebsd 15 Jan 2015
built on: date not available
options:bn(64,64) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: clang
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128 cbc 20245.49k 21646.52k 22179.87k 55431.85k 55981.40k
0(alix_APU1c4)#
RELENG9
1{alix_APU1c4}# openssl speed aes-128-cbc
To get the most accurate results, try to run this
program when this computer is idle.
Doing aes-128 cbc for 3s on 16 size blocks: 6396101 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1666730 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 425420 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 106883 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 13367 aes-128 cbc's in 3.00s
OpenSSL 0.9.8zd-freebsd 8 Jan 2015
built on: date not available
options:bn(64,64) md2(int) rc4(ptr,int) des(idx,cisc,16,int) aes(partial) blowfish(idx)
compiler: cc
available timing options: USE_TOD HZ=128 [sysconf value]
timing function used: getrusage
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128 cbc 34178.77k 35559.29k 36305.70k 36481.34k 36495.49k
0{alix_APU1c4}#
RELENG9 from the ports
0{alix_APU1c4}# /usr/local/bin/openssl speed aes-128-cbc
WARNING: can't open config file: /usr/local/openssl/openssl.cnf
Doing aes-128 cbc for 3s on 16 size blocks: 3792299 aes-128 cbc's in 2.99s
Doing aes-128 cbc for 3s on 64 size blocks: 1014482 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 256 size blocks: 259813 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 1024 size blocks: 166623 aes-128 cbc's in 3.00s
Doing aes-128 cbc for 3s on 8192 size blocks: 21016 aes-128 cbc's in 3.00s
OpenSSL 1.0.1l 15 Jan 2015
built on: Thu Mar 19 00:11:03 2015
options:bn(64,64) md2(int) rc4(8x,int) des(idx,cisc,16,int) aes(partial) idea(int) blowfish(idx)
compiler: cc -I. -I.. -I../include -fPIC -DOPENSSL_PIC -DZLIB_SHARED -DZLIB -DOPENSSL_THREADS -pthread -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -Wa,--noexecstack -DL_ENDIAN
-DTERMIOS -O3 -Wall -O2 -pipe -fstack-protector -fno-strict-aliasing -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSH
A256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes
aes-128 cbc 20278.40k 21642.28k 22170.71k 56873.98k 57387.69k
0{alix_APU1c4}# /usr/local/bin/openssl version
WARNING: can't open config file: /usr/local/openssl/openssl.cnf
OpenSSL 1.0.1l 15 Jan 2015
More information about the freebsd-stable
mailing list