Sensei throughput cap despite high-performance device

[Nanrada Suwam]

I am running OPNSense on a dedicated i7 CPU with 32 GB of memory and 6 gbps ports. Ubench CPU 1132791 and Ubench MEM 2337171. My internet connection is 1 gpbs.

Before installing and enabling Sensei, average throughput on fast.com or speedtest.com was close to 1.0 gbps with a usual overhead penalty. But when Sensei is installed and active on LAN ports (L3 mode with either native or generic nmap driver), throughput drops to 250 mbps - mere 25% of available bandwidth. CPU is idling and never goes above 15%.

I installed the new 20.7.3-netmap driver - but that didn't change the throughput at all.

What am I doing wrong? What troubleshooting data would you like to see?

pg betflik

[athurdent]

Speed may also on your network card/driver. Which card is in there?
https://www.sunnyvalley.io/docs/introduction/hardware-requirements#ethernet-adapter

[sy]

Hi,

It could be a netmap issue. Please try in bypass mode (Zenarmor GUI - Status- Services - Zenarmor PAcket Engine - Enter Bypass Mode) and send a bug report from the upper right corner of GUI by selecting all checkboxes.

[almodovaris]

I don't know. I use an Intel(R) Core(TM) i5-4690 CPU @ 3.50GHz with 16 GB RAM and an Intel 1 Gbps network card. It delivers 600 Mbps download speed from 600 Mbps nominal speed, with Sensei fully enabled.

I don't think there is a real speed difference between native netmap and emulated netmap, but I found the emulated netmap to work smoother.

[almodovaris]

According to top eastpect uses 40% to 50% of a single core of the processor at 600 Mbps download speed.

[nikkon]

I experience the same behaviour. Without Zenarmor I get 600 Mbps download. With Zenarmor I only get 300-350 Mpbs
The setup I have for Opnsense is an atom 8 cores, 16 GB ram ecc, Intel Gigabit NICs
However when I am running the tests I follow the resource allocation/consumption and neither the CPU or Ram seem to be under stress. I think it's software bottleneck

[sy]

Hi,

Did you test with iperf?

[almodovaris]

Frequency of the processor matters. It takes 2.4 GHz nominal frequency to handle 600 Mbps. So if you have an old PC that you think it is not useful anymore, it can function as your firewall.

Eastpect is single-core process, that's why it matters.

[nikkon]

Cpu is actually 2.4 Ghz