root@opn:/usr/local/etc/suricata/rules # ls *.rulesOPNsense.rules emerging-icmp_info.rulesabuse.ch.feodotracker.rules emerging-imap.rulesabuse.ch.sslblacklist.rules emerging-info.rulesabuse.ch.sslipblacklist.rules emerging-malware.rulesabuse.ch.urlhaus.rules emerging-misc.rulesbotcc.portgrouped.rules emerging-mobile_malware.rulesbotcc.rules emerging-rpc.rulesciarmy.rules emerging-scan.rulescompromised.rules emerging-shellcode.rulesdrop.rules emerging-smtp.rulesdshield.rules emerging-sql.rulesemerging-activex.rules emerging-trojan.rulesemerging-attack_response.rules emerging-user_agents.rulesemerging-current_events.rules emerging-web_client.rulesemerging-deleted.rules emerging-web_server.rulesemerging-dns.rules emerging-web_specific_apps.rulesemerging-dos.rules emerging-worm.rulesemerging-exploit.rules opnsense.test.rulesemerging-ftp.rules opnsense.uncategorized.rulesemerging-icmp.rulesroot@opn:/usr/local/etc/suricata/rules # cat *.rules | sed 's/^ *#.*//' | sed '/^ *$/d' | wc -l 41614
### loader.conf.local# Flow Control (FC): 0 = Disabled, 1 = Rx Pause, 2 = Tx Pause, 3 = Full FChw.igb.0.fc=0hw.igb.1.fc=0hw.igb.2.fc=0hw.igb.3.fc=0# Set number of queues to number of cores divided by number of ports, 0 lets FreeBSD decide (should be default)hw.igb.num_queues=0# Increase packet descriptors (set as 1024, 2048 or 4096 ONLY)hw.igb.rxd="4096" # Default = 1024hw.igb.txd="4096"net.link.ifqmaxlen="8192" # Sum of above two (default = 50)# Increase network efficiency (Adaptive Interrupt Moderation, should be default)hw.igb.enable_aim=1# Increase interrupt rate # Default = 8000hw.igb.max_interrupt_rate="64000"# Fast interrupt handling, allows NIC to process packets as fast as they are received (should be default)hw.igb.enable_msix=1hw.pci.enable_msix=1# Unlimited packet processinghw.igb.rx_process_limit="-1"hw.igb.tx_process_limit="-1"### WebGUI > System > Settings > Tunables# Disable Energy Efficient Ethernetdev.igb.0.eee_disabled=1dev.igb.1.eee_disabled=1dev.igb.2.eee_disabled=1dev.igb.3.eee_disabled=1# Set Flow Controlhw.igb.0.fc=0hw.igb.1.fc=0hw.igb.2.fc=0hw.igb.3.fc=0dev.igb.0.fc=0dev.igb.1.fc=0dev.igb.2.fc=0dev.igb.3.fc=0# Do not accept IPv4 fragmentsnet.inet.ip.maxfragpackets=0net.inet.ip.maxfragsperpacket=0
$ iperf -c vps1 -p 4712 -u -t 60 -i 10 -b 1000M------------------------------------------------------------Client connecting to vps1, UDP port 4712Sending 1470 byte datagrams, IPG target: 11.22 us (kalman adjust)UDP buffer size: 9.00 KByte (default)------------------------------------------------------------[ ID] Interval Transfer Bandwidth[ 5] 0.0-10.0 sec 1.11 GBytes 954 Mbits/sec[ 5] 10.0-20.0 sec 1.11 GBytes 952 Mbits/sec[ 5] 20.0-30.0 sec 1.11 GBytes 954 Mbits/sec[ 5] 30.0-40.0 sec 1.11 GBytes 953 Mbits/sec[ 5] 40.0-50.0 sec 1.11 GBytes 955 Mbits/sec[ 5] 0.0-60.0 sec 6.66 GBytes 953 Mbits/sec[ 5] Sent 4864635 datagrams
iperf -p 5201 -c 192.168.1.99 -u -b 10m -P 100 -d -t 60
Tracing command kernel pid 0 tid 100162 td 0xfffff8001ffb1560sched_switch() at sched_switch+0x4aa/frame 0xfffffe0467a1daa0mi_switch() at mi_switch+0xe5/frame 0xfffffe0467a1dad0sleepq_wait() at sleepq_wait+0x3a/frame 0xfffffe0467a1db00_sleep() at _sleep+0x255/frame 0xfffffe0467a1db80taskqueue_thread_loop() at taskqueue_thread_loop+0x121/frame 0xfffffe0467a1dbb0fork_exit() at fork_exit+0x85/frame 0xfffffe0467a1dbf0fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0467a1dbf0--- trap 0, rip = 0, rsp = 0, rbp = 0 ---Tracing command kernel pid 0 tid 100173 td 0xfffff800099dd000sched_switch() at sched_switch+0x4aa/frame 0xfffffe0467a54aa0mi_switch() at mi_switch+0xe5/frame 0xfffffe0467a54ad0sleepq_wait() at sleepq_wait+0x3a/frame 0xfffffe0467a54b00_sleep() at _sleep+0x255/frame 0xfffffe0467a54b80taskqueue_thread_loop() at taskqueue_thread_loop+0x121/frame 0xfffffe0467a54bb0fork_exit() at fork_exit+0x85/frame 0xfffffe0467a54bf0fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0467a54bf0--- trap 0, rip = 0, rsp = 0, rbp = 0 ---db:0:kdb.enter.default> capture offdb:0:kdb.enter.default> call doadump= 0x6db:0:kdb.enter.default> resetcpu_reset: Restarting BSPcpu_reset_proxy: Stopped CPU 7
To followup, Brent Cowing of Protectli sent me a i3-7100U based box and my speeds are back to 910/949.see also:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237072https://github.com/HardenedBSD/hardenedBSD/issues/376I will also have a 2nd E3845 box here this week (thanks Brent), and will able to play and not affect my internet connection.
Quote from: lrosenman on April 09, 2019, 04:40:33 amTo followup, Brent Cowing of Protectli sent me a i3-7100U based box and my speeds are back to 910/949.see also:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=237072https://github.com/HardenedBSD/hardenedBSD/issues/376I will also have a 2nd E3845 box here this week (thanks Brent), and will able to play and not affect my internet connection. Is this with IPS/IDS turned on? I get 870/950 with the igbX tunables and no IPS/IDS. When I turn on IPS/IDS, the speedtest.net download speed starts at 800-900 mbps and slowly levels off at 100-200 mbps. The upload speed starts at 10 mbps and then the test errors out. I wonder if this has something to do with netgraph ...