OPNsense Forum

English Forums => Sensei => Topic started by: binaryanomaly on May 13, 2021, 07:59:34 am

Title: Speedtests Sensei and Suricata
Post by: binaryanomaly on May 13, 2021, 07:59:34 am
Hi,

Just wanted to share my speedtestresults to see if folks here observe similar behaviour.
VM-to-VM, Suricata using Hyperscan pattern matcher with ET Pro Telemetry rules, speedtest-cli (Ookla).


The speed decrease when using Suricata and Sensei together is quite significant.
Anything one can do about this?




Detailed test results:

Suricata❌, Sensei❌
Code: [Select]
    Latency:     1.90 ms   (0.49 ms jitter)
   Download:  8047.50 Mbps (data used: 4.0 GB)
     Upload:  7408.12 Mbps (data used: 8.7 GB)

Suricata✅, Sensei❌
Code: [Select]
    Latency:     1.49 ms   (0.19 ms jitter)
   Download:  8036.28 Mbps (data used: 5.6 GB)
     Upload:  7309.16 Mbps (data used: 8.9 GB)

Suricata❌, Sensei✅
Code: [Select]
    Latency:     2.84 ms   (0.19 ms jitter)
   Download:  4705.11 Mbps (data used: 7.4 GB)
     Upload:  5264.34 Mbps (data used: 6.4 GB)

Suricata✅[, Sensei✅
Code: [Select]
    Latency:     2.92 ms   (0.28 ms jitter)
   Download:  2819.69 Mbps (data used: 3.0 GB)
     Upload:  1090.61 Mbps (data used: 670.7 MB)
Title: Re: Speedtests Sensei and Suricata
Post by: sy on May 20, 2021, 07:50:32 pm
Hi,

Did you try Sensei in bypass mode?
Title: Re: Speedtests Sensei and Suricata
Post by: binaryanomaly on May 20, 2021, 08:04:28 pm
Hi,

Did you try Sensei in bypass mode?

No, stopped the engine completely.
Why should I test in bypass mode? I either would want it off completely or fully functional.
Title: Re: Speedtests Sensei and Suricata
Post by: sy on May 21, 2021, 07:25:02 pm
Hi,

The bypass will provide us the info that slowness is due to engine or netmap. In Bypass mode, Sensei just forward the packets. If the results are the same in bypass mode, we should check the netmap side.
Title: Re: Speedtests Sensei and Suricata
Post by: binaryanomaly on May 21, 2021, 09:03:09 pm
Hi,

The bypass will provide us the info that slowness is due to engine or netmap. In Bypass mode, Sensei just forward the packets. If the results are the same in bypass mode, we should check the netmap side.

Ok thanks, I understand.

The results are almost identical in bypass mode:

Code: [Select]
    Latency:     2.79 ms   (0.23 ms jitter)
   Download:  2705.55 Mbps (data used: 2.6 GB)
     Upload:  1146.04 Mbps (data used: 1.2 GB)
Title: Re: Speedtests Sensei and Suricata
Post by: W0nderW0lf on May 22, 2021, 07:55:04 pm
I have the same problem, but since I dont need that much speed for the stuff I do, I have to life with 1/3 of my full speed.
It's depending on your hardware. I still use a J1900 CPU and thats a pretty old and slow one
Title: Re: Speedtests Sensei and Suricata
Post by: binaryanomaly on May 22, 2021, 09:13:25 pm
Well, I can live with ~3 Gbps that's not really an issue  ;)

Nevertheless the drop in performance is significant and probably not without impact on weaker hardware. Also it would allow to waste less resources in virtualization scenarios, generate less heat, etc., etc.

I have a 11th Gen Intel(R) Core(TM) i5-11600 @ 2.80GHz at work here, 4 cores for OPNsense, somewhat doubt that it is the bottleneck. On the other hand it seems to be somewhat stuck around 2.7/8 Gbps also with the previous hardware.