Does zenarmor get any benefit from RSS?

[Vilmalith]

I am testing RSS on my topton i5 2.5gbe device and have noticed in game/app decreases in latency.  But there is a Zenarmor warning about possible issues when it notices that RSS is enabled.  Though it doesn't go in to detail about what these issues could be.

Is Zenarmor fully functional and performant when RSS is enabled?

[sy]

Hi,

It is determined a performance issue on netmap when RSS is enabled. So it is added a warning if RSS is enabled. Your latency is most probably due to the netmap issue.

[sritodi]

The warning label seems to need an update, it reads

RSS (Receive Side Scaling) Enabled
It looks like you've enabled RSS (Receive Side Scaling) kernel support. Please be noted that RSS support is quite new. If you experience throughput problems, please disable RSS and try again.
You can check if RSS is enabled in the System - Settings - Tunables - net.inet.rss.enabled=1. Please remove the entry to disable RSS.

[dinguz]

If this message is being revisited, it would help to also add some form of rate-limiting to it. At the moment it re-appears every session, which gets old fast. Showing it once a week (or once per change to the RSS setting) would be plenty.

I already raised this via helpdesk request #14474 (April 2026).

[Cljackhammer]

No, RSS does not work properly with Zenarmor. In fact, there is little reason to use RSS alongside Zenarmor because Zenarmor pins its processing to individual CPU cores. This is why Zenarmor presents this "warning"

If you check the status (vmstat -i | grep rx) with both RSS and Zenarmor enabled, you can see that the majority of the packets end up being processed by a single queue (CPU core), effectively negating the benefits of RSS.

Zenarmor also introduces bufferbloat because of its single-core architecture. This becomes particularly apparent when you move beyond 1 Gbps. After upgrading to a 2.5 Gbps symmetrical Internet connection, the limitations and inefficiencies of the Zenarmor architecture became much more obvious.

There are more efficient alternatives that utilize true multi-core/multi-threaded architectures without putting that functionality behind a "business" tier.

In my experience, Zenarmor was designed around—and is really only able to efficiently handle connections up to around 1 Gbps. Even if you can achieve higher throughput, you often pay for it with increased latency and bufferbloat. So while it may technically push more than 1 Gbps, the overall performance and latency characteristics are not particularly efficient at those speeds. I suspect that part of the issue is Netmap.