Netzwerkdurchsatz Frage

[pointde]

Bisher war auf dieser Hardware Securepoint drauf. Soweit ich mich erinnern kann, gab es hier nie Performance Probleme. Da es mir komisch vorkam, dass nach der opnsense Installation z. B. Acronis für das Backup meines Clients auf den Server um ein vielfaches länger braucht als vorher habe ich mit iperf eine Durchsatzmessung gemacht. Die CPU-Last der Firewall geht zwischenzeitlich auf 100% hoch. Ich hoffe, ihr könnt aus den Screenshots alle nötigen Daten herauslesen. Mir kommt das Ganze ziemlich komisch vor...

[Patrick M. Hausen]

Hast Du Suricata oder Sensei an?
Was für eine Netzwerkhardware hat das Gerät?

[pointde]

Nein, ist nichts davon an.
Ist eine Scope 7 1020 mit Lanner Netzwerktechnologie

[Patrick M. Hausen]

Welcher Hardware-Typ Netzwerkkarte genau? Intel? Broadcomm? Realtek? Das sagt Dir "cat /var/run/dmesg.boot".

Bei mir z.B.

Code: [Select]

ix0: <Intel(R) X553 (1GbE)> mem 0xddc00000-0xdddfffff,0xdde04000-0xdde07fff at device 0.0 on pci5
ix0: Using 2048 TX descriptors and 2048 RX descriptors
ix0: Using 4 RX queues 4 TX queues
ix0: Using MSI-X interrupts with 5 vectors
ix0: allocated for 4 queues
ix0: allocated for 4 rx queues
ix0: Ethernet address: 3c:ec:ef:00:54:30
ix0: netmap queues/slots: TX 4/2048, RX 4/2048

[pointde]

Dies ist die komplette Ausgabe:

Code: [Select]

---<<BOOT>>---
Copyright (c) 2013-2019 The HardenedBSD Project.
Copyright (c) 1992-2019 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 12.1-RELEASE-p19-HBSD #0  c89981353e9(stable/21.7)-dirty: Wed Jul 21 14:36:43 CEST 2021
    root@sensey:/usr/obj/usr/src/amd64.amd64/sys/SMP amd64
FreeBSD clang version 8.0.1 (tags/RELEASE_801/final 366581) (based on LLVM 8.0.1)
VT(vga): resolution 640x480
HardenedBSD: initialize and check features (__HardenedBSD_version 1200059 __FreeBSD_version 1201000).
CPU: Intel(R) Celeron(R) CPU  N3010  @ 1.04GHz (1040.04-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x406c4  Family=0x6  Model=0x4c  Stepping=4
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x43d8e3bf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,TSCDLT,AESNI,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2282<TSCADJ,SMEP,ERMS,NFPUSG>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
  TSC: P-state invariant, performance statistics
real memory  = 4294967296 (4096 MB)
avail memory = 3970400256 (3786 MB)
Event timer "LAPIC" quality 600
ACPI APIC Table: <ALASKA A M I >
WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
FreeBSD/SMP: 1 package(s) x 2 core(s)
random: unblocking device.
ioapic0 <Version 2.0> irqs 0-114 on motherboard
Launching APs: 1
Timecounter "TSC" frequency 1040035451 Hz quality 1000
wlan: mac acl policy registered
random: entropy device external interface
kbd0 at kbdmux0
module_register_init: MOD_LOAD (vesa, 0xffffffff812907f0, 0) error 19
random: registering fast source Intel Secure Key RNG
random: fast provider: "Intel Secure Key RNG"
000.000052 [4344] netmap_init               netmap: loaded module
[ath_hal] loaded
nexus0
efirtc0: <EFI Realtime Clock> on motherboard
efirtc0: registered as a time-of-day clock, resolution 1.000000s
cryptosoft0: <software crypto> on motherboard
acpi0: <ALASKA A M I > on motherboard
acpi0: Power Button (fixed)
unknown: I/O range not supported
cpu0: <ACPI CPU> on acpi0
atrtc0: <AT realtime clock> port 0x70-0x77 on acpi0
atrtc0: Warning: Couldn't map I/O.
atrtc0: registered as a time-of-day clock, resolution 1.000000s
Event timer "RTC" frequency 32768 Hz quality 0
attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
Timecounter "ACPI-safe" frequency 3579545 Hz quality 850
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0x80000000-0x80ffffff,0x90000000-0x9fffffff irq 16 at device 2.0 on pci0
vgapci0: Boot video device
pci0: <multimedia> at device 3.0 (no driver attached)
ahci0: <AHCI SATA controller> port 0xf060-0xf07f mem 0x81915000-0x819157ff irq 19 at device 19.0 on pci0
ahci0: AHCI v1.31 with 2 6Gbps ports, Port Multiplier not supported
ahcich0: <AHCI channel> at channel 0 on ahci0
ahcich1: <AHCI channel> at channel 1 on ahci0
xhci0: <Intel Braswell USB 3.0 controller> mem 0x81900000-0x8190ffff irq 20 at device 20.0 on pci0
xhci0: 32 bytes context size, 64-bit DMA
usbus0 on xhci0
usbus0: 5.0Gbps Super Speed USB v3.0
pci0: <encrypt/decrypt> at device 26.0 (no driver attached)
hdac0: <Intel (0x2284) HDA Controller> mem 0x81910000-0x81913fff irq 22 at device 27.0 on pci0
pcib1: <ACPI PCI-PCI bridge> at device 28.0 on pci0
pcib1: [GIANT-LOCKED]
pcib2: <ACPI PCI-PCI bridge> at device 28.1 on pci0
pcib2: [GIANT-LOCKED]
pci1: <ACPI PCI bus> on pcib2
igb0: <Intel(R) I211 (Copper)> port 0xe000-0xe01f mem 0x81800000-0x8181ffff,0x81820000-0x81823fff irq 17 at device 0.0 on pci1
igb0: Using 1024 TX descriptors and 1024 RX descriptors
igb0: Using 2 RX queues 2 TX queues
igb0: Using MSI-X interrupts with 3 vectors
igb0: Ethernet address: 00:90:0b:6b:d7:44
igb0: netmap queues/slots: TX 2/1024, RX 2/1024
pcib3: <ACPI PCI-PCI bridge> at device 28.2 on pci0
pci2: <ACPI PCI bus> on pcib3
igb1: <Intel(R) I211 (Copper)> port 0xd000-0xd01f mem 0x81700000-0x8171ffff,0x81720000-0x81723fff irq 18 at device 0.0 on pci2
igb1: Using 1024 TX descriptors and 1024 RX descriptors
igb1: Using 2 RX queues 2 TX queues
igb1: Using MSI-X interrupts with 3 vectors
igb1: Ethernet address: 00:90:0b:6b:d7:45
igb1: netmap queues/slots: TX 2/1024, RX 2/1024
pcib4: <ACPI PCI-PCI bridge> at device 28.3 on pci0
pci3: <ACPI PCI bus> on pcib4
igb2: <Intel(R) I211 (Copper)> port 0xc000-0xc01f mem 0x81600000-0x8161ffff,0x81620000-0x81623fff irq 19 at device 0.0 on pci3
igb2: Using 1024 TX descriptors and 1024 RX descriptors
igb2: Using 2 RX queues 2 TX queues
igb2: Using MSI-X interrupts with 3 vectors
igb2: Ethernet address: 00:90:0b:6b:d7:46
igb2: netmap queues/slots: TX 2/1024, RX 2/1024
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
acpi_button0: <Sleep Button> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff pnpid PNP0900 on isa0
est0: <Enhanced SpeedStep Frequency Control> on cpu0
est: CPU supports Enhanced Speedstep, but is not recognized.
est: cpu_vendor GenuineIntel, msr 640000000d32
device_attach: est0 attach returned 6
est: CPU supports Enhanced Speedstep, but is not recognized.
est: cpu_vendor GenuineIntel, msr 640000000d32
device_attach: est1 attach returned 6
Timecounters tick every 1.000 msec
hdacc0: <Intel (0x2883) HDA CODEC> at cad 2 on hdac0
hdaa0: <Intel (0x2883) Audio Function Group> at nid 1 on hdacc0
pcm0: <Intel (0x2883) (HDMI/DP 8ch)> at nid 7 on hdaa0
pcm1: <Intel (0x2883) (HDMI/DP 8ch)> at nid 5 on hdaa0
pcm2: <Intel (0x2883) (HDMI/DP 8ch)> at nid 6 on hdaa0
ugen0.1: <0x8086 XHCI root HUB> at usbus0
uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
ada0 at ahcich1 bus 0 scbus1 target 0 lun 0
ada0: <TS32GMSM610 20140730> ATA8-ACS SATA 2.x device
ada0: Serial Number 04088267E28095700005
ada0: 300.000MB/s transfers (SATA 2.x, UDMA6, PIO 512bytes)
ada0: 30533MB (62533296 512 byte sectors)
Trying to mount root from ufs:/dev/gpt/rootfs [rw,noatime]...
WARNING: /mnt was not properly dismounted
WARNING: /mnt: mount pending error: blocks 296 files 1
WARNING: /mnt: reload pending error: blocks 296 files 1
WARNING: /mnt: reload pending error: blocks 296 files 1
uhub0: 13 ports with 13 removable, self powered
WARNING: /mnt: reload pending error: blocks 296 files 1
root@OPNsense:~ # clear
root@OPNsense:~ # cat /var/run/dmesg.boot
---<<BOOT>>---
Copyright (c) 2013-2019 The HardenedBSD Project.
Copyright (c) 1992-2019 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
        The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 12.1-RELEASE-p19-HBSD #0  c89981353e9(stable/21.7)-dirty: Wed Jul 21 14:36:43 CEST 2021
    root@sensey:/usr/obj/usr/src/amd64.amd64/sys/SMP amd64
FreeBSD clang version 8.0.1 (tags/RELEASE_801/final 366581) (based on LLVM 8.0.1)
VT(vga): resolution 640x480
HardenedBSD: initialize and check features (__HardenedBSD_version 1200059 __FreeBSD_version 1201000).
CPU: Intel(R) Celeron(R) CPU  N3010  @ 1.04GHz (1040.04-MHz K8-class CPU)
  Origin="GenuineIntel"  Id=0x406c4  Family=0x6  Model=0x4c  Stepping=4
  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
  Features2=0x43d8e3bf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,TSCDLT,AESNI,RDRAND>
  AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM>
  AMD Features2=0x101<LAHF,Prefetch>
  Structured Extended Features=0x2282<TSCADJ,SMEP,ERMS,NFPUSG>
  VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
  TSC: P-state invariant, performance statistics
real memory  = 4294967296 (4096 MB)
avail memory = 3970400256 (3786 MB)
Event timer "LAPIC" quality 600
ACPI APIC Table: <ALASKA A M I >
WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
FreeBSD/SMP: 1 package(s) x 2 core(s)
random: unblocking device.
ioapic0 <Version 2.0> irqs 0-114 on motherboard
Launching APs: 1
Timecounter "TSC" frequency 1040035451 Hz quality 1000
wlan: mac acl policy registered
random: entropy device external interface
kbd0 at kbdmux0
module_register_init: MOD_LOAD (vesa, 0xffffffff812907f0, 0) error 19
random: registering fast source Intel Secure Key RNG
random: fast provider: "Intel Secure Key RNG"
000.000052 [4344] netmap_init               netmap: loaded module
[ath_hal] loaded
nexus0
efirtc0: <EFI Realtime Clock> on motherboard
efirtc0: registered as a time-of-day clock, resolution 1.000000s
cryptosoft0: <software crypto> on motherboard
acpi0: <ALASKA A M I > on motherboard
acpi0: Power Button (fixed)
unknown: I/O range not supported
cpu0: <ACPI CPU> on acpi0
atrtc0: <AT realtime clock> port 0x70-0x77 on acpi0
atrtc0: Warning: Couldn't map I/O.
atrtc0: registered as a time-of-day clock, resolution 1.000000s
Event timer "RTC" frequency 32768 Hz quality 0
attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
Timecounter "i8254" frequency 1193182 Hz quality 0
Event timer "i8254" frequency 1193182 Hz quality 100
Timecounter "ACPI-safe" frequency 3579545 Hz quality 850
acpi_timer0: <24-bit timer at 3.579545MHz> port 0x408-0x40b on acpi0
pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
pci0: <ACPI PCI bus> on pcib0
vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0x80000000-0x80ffffff,0x90000000-0x9fffffff irq 16 at device 2.0 on pci0
vgapci0: Boot video device
pci0: <multimedia> at device 3.0 (no driver attached)
ahci0: <AHCI SATA controller> port 0xf060-0xf07f mem 0x81915000-0x819157ff irq 19 at device 19.0 on pci0
ahci0: AHCI v1.31 with 2 6Gbps ports, Port Multiplier not supported
ahcich0: <AHCI channel> at channel 0 on ahci0
ahcich1: <AHCI channel> at channel 1 on ahci0
xhci0: <Intel Braswell USB 3.0 controller> mem 0x81900000-0x8190ffff irq 20 at device 20.0 on pci0
xhci0: 32 bytes context size, 64-bit DMA
usbus0 on xhci0
usbus0: 5.0Gbps Super Speed USB v3.0
pci0: <encrypt/decrypt> at device 26.0 (no driver attached)
hdac0: <Intel (0x2284) HDA Controller> mem 0x81910000-0x81913fff irq 22 at device 27.0 on pci0
pcib1: <ACPI PCI-PCI bridge> at device 28.0 on pci0
pcib1: [GIANT-LOCKED]
pcib2: <ACPI PCI-PCI bridge> at device 28.1 on pci0
pcib2: [GIANT-LOCKED]
pci1: <ACPI PCI bus> on pcib2
igb0: <Intel(R) I211 (Copper)> port 0xe000-0xe01f mem 0x81800000-0x8181ffff,0x81820000-0x81823fff irq 17 at device 0.0 on pci1
igb0: Using 1024 TX descriptors and 1024 RX descriptors
igb0: Using 2 RX queues 2 TX queues
igb0: Using MSI-X interrupts with 3 vectors
igb0: Ethernet address: 00:90:0b:6b:d7:44
igb0: netmap queues/slots: TX 2/1024, RX 2/1024
pcib3: <ACPI PCI-PCI bridge> at device 28.2 on pci0
pci2: <ACPI PCI bus> on pcib3
igb1: <Intel(R) I211 (Copper)> port 0xd000-0xd01f mem 0x81700000-0x8171ffff,0x81720000-0x81723fff irq 18 at device 0.0 on pci2
igb1: Using 1024 TX descriptors and 1024 RX descriptors
igb1: Using 2 RX queues 2 TX queues
igb1: Using MSI-X interrupts with 3 vectors
igb1: Ethernet address: 00:90:0b:6b:d7:45
igb1: netmap queues/slots: TX 2/1024, RX 2/1024
pcib4: <ACPI PCI-PCI bridge> at device 28.3 on pci0
pci3: <ACPI PCI bus> on pcib4
igb2: <Intel(R) I211 (Copper)> port 0xc000-0xc01f mem 0x81600000-0x8161ffff,0x81620000-0x81623fff irq 19 at device 0.0 on pci3
igb2: Using 1024 TX descriptors and 1024 RX descriptors
igb2: Using 2 RX queues 2 TX queues
igb2: Using MSI-X interrupts with 3 vectors
igb2: Ethernet address: 00:90:0b:6b:d7:46
igb2: netmap queues/slots: TX 2/1024, RX 2/1024
isab0: <PCI-ISA bridge> at device 31.0 on pci0
isa0: <ISA bus> on isab0
acpi_button0: <Sleep Button> on acpi0
acpi_tz0: <Thermal Zone> on acpi0
uart0: <16550 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
uart0: console (115200,n,8,1)
vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff pnpid PNP0900 on isa0
est0: <Enhanced SpeedStep Frequency Control> on cpu0
est: CPU supports Enhanced Speedstep, but is not recognized.
est: cpu_vendor GenuineIntel, msr 640000000d32
device_attach: est0 attach returned 6
est: CPU supports Enhanced Speedstep, but is not recognized.
est: cpu_vendor GenuineIntel, msr 640000000d32
device_attach: est1 attach returned 6
Timecounters tick every 1.000 msec
hdacc0: <Intel (0x2883) HDA CODEC> at cad 2 on hdac0
hdaa0: <Intel (0x2883) Audio Function Group> at nid 1 on hdacc0
pcm0: <Intel (0x2883) (HDMI/DP 8ch)> at nid 7 on hdaa0
pcm1: <Intel (0x2883) (HDMI/DP 8ch)> at nid 5 on hdaa0
pcm2: <Intel (0x2883) (HDMI/DP 8ch)> at nid 6 on hdaa0
ugen0.1: <0x8086 XHCI root HUB> at usbus0
uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
ada0 at ahcich1 bus 0 scbus1 target 0 lun 0
ada0: <TS32GMSM610 20140730> ATA8-ACS SATA 2.x device
ada0: Serial Number 04088267E28095700005
ada0: 300.000MB/s transfers (SATA 2.x, UDMA6, PIO 512bytes)
ada0: 30533MB (62533296 512 byte sectors)
Trying to mount root from ufs:/dev/gpt/rootfs [rw,noatime]...
WARNING: /mnt was not properly dismounted
WARNING: /mnt: mount pending error: blocks 296 files 1
WARNING: /mnt: reload pending error: blocks 296 files 1
WARNING: /mnt: reload pending error: blocks 296 files 1
uhub0: 13 ports with 13 removable, self powered
WARNING: /mnt: reload pending error: blocks 296 files 1
root@OPNsense:~ #


.... Also Intel:  <Intel(R) I211

[Patrick M. Hausen]

Mit der 21.7 gab es m.W. ein kleineres Problem mit igb(4) - warte mal das Update ab, das heute kommt.

[pointde]

War aber vorher auch schon. Habe glaube ich im Mai schon umgestellt...

[Patrick M. Hausen]

VLANs und/oder Bridge im Einsatz?

[pointde]

Ja, mehrere VLAN´s

[Patrick M. Hausen]

Hast Du denn auch bei den phys. Interfaces das Hardware Offloading aus?

[pointde]

Du meinst aber schon das, oder?:
Edit: Sorry, Screenshot zu spät gesehen von dir.

[micneu]

also, deine cpu ist ja nicht wirklich der bringer. ich weiß ja nicht was man von einer so kleinen cpu erwartet.
was für tests hast du denn gemacht, bei welcher funktion ist die cpu langsam (VPN, sürfen)?

[pointde]

Für mein kleines Heim Netzwerk müsste die doch eigentlich leicht reichen, oder? Mir ist es am brutalsten beim kopieren auf den Server aufgefallen.

[Redundanz]

iperf test mit zusätzlichem parameter -u   (udp) getestet? gleiche CPU auslastung? oder niedriger?

wo stehen denn server und client im verhältnis zur firewall. ist da noch "cloud" dazwischen? bzw. geht es via VPN?
oder spielt sich das nur innerhalb eines heterogenen heimnetzwerks ab?

welches dateitransferprotokoll wird verwendet? cifs/smb? nfs? scp?

bei so einem - sagen wir mal fairerweise - "relativ" schwachen prozessor können encapsulation und/oder breitbandiger tcp traffic schwer ins gewicht fallen.
falls das über vpn geht, sicherstellen dass openvpn auf udp läuft. wireguard dürfte m.w. nur udp unterstützen.

[pointde]

Anbei ein Screenshot mit dem Parameter -u. Prozessorleistung geht dabei nur auf 16% hoch.
Alles spielt sich innerhalb eines heterogenen Netzwerks ab.
Nur Windows Geräte (Clients Win10, Server 2019 Standard)
An der Infrastruktur, sowie der Hardware wurde ja nichts geändert. Vorher lief halt die Securepoint Software auf dieser Hardware....