@sullrich:
@maunded:
Yes, the client software reports the errors, I believe they were all request timeouts, when I say 10+ I mean there were on average about 10-15 errors in 9000 requests
I dont have the vmtools loaded on any of the servers, I will try that next week.
Any idea why the request/sec was so low for pf? I thought that it may be because the client software I am using is sending all requests from one machine? Does pf have some sort of connection throttling? Is it trying to defend itself against a SYN flood? Is there anywhere I might start to look for errors?
D.
In a nutshell: VMWare + FreeBSD networking performance sucks. I would try these tests with real hardware. I know this is not what you want to hear but its true.
There's also a possibility that it's state table collisions (pf flushes expired states every 10 seconds by default). In the real world you'll see connections from a larger number of IP addresses so this tends to be less of an issue. This may, or may not be the problem here, just offering up another suggestion ;)
FWIW, I've got hosts that do 1000 state table insertions and removals / second with 90K active states w/ no problems. This is on PF's native platform though, I can't speak for FreeBSD although a number of people have mentioned similar numbers to me personally.
–Bill
