Intel NIC I-226V

Antibiotic

@Antibiotic BTW tried Snort in inline mode and AP router speed dropped down till 80/100Mb insteed of my 1Gb.

bmeeks

@Antibiotic BTW tried Snort in inline mode and AP router speed dropped down till 80/100Mb insteed of my 1Gb.

If that CPU can't do better than 80/100 MB with Snort inline, then something else is seriously wrong with your configuration. At worst I would expect speeds to drop to about 50% of normal with Snort, and even less of a drop with Suricata (since it is multithreaded).

Seems that particular NIC may have issues. Here is a thread I found on Reditt: https://www.reddit.com/r/intel/comments/123kjuc/anyone_else_still_having_issues_with_i226v/. And another one from a different forum: https://www.overclock.net/threads/design-flaw-on-the-intel-ethernet-1226-v-2-5-gbe-controller.1805716/. And one more: https://forums.tomshardware.com/threads/i226-v-issues-hardware-or-software-related.3801887/.

Antibiotic

@bmeeks Thank to you my friend, will take a look. But this drop going on router in AP mode not home network like a PC over cable connection.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks Thank to you my friend, will take a look. But this drop going on router in AP mode not home network like a PC over cable connection.

You're making no sense here. Are you talking about speed issues over a wireless connection or a wired connection? Wireless is 1000% different from a wired connection. You can almost never get 1 Gig/sec speeds on wireless unless you stand like 5 feet from the AP, there is zero interference from any other device in the vicinity, and of course you have a 6E capable AP.

Antibiotic

@bmeeks I mean in complex wired and wireless, agree that with wireless could be a different cause of dropping. But anyway, with Hardware Checksum Offloading ON and snort deinstalled wireless speed almost as my ISP/ 1Gb on wireless router in AP mode ( But wireless router is power Asus RT-AX86U Pro)

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks I mean in complex wired and wireless, agree that with wireless could be a different cause of dropping. But anyway, with Hardware Checksum Offloading ON and snort deinstalled wireless speed almost as my ISP/ 1Gb on wireless router in AP mode ( But wireless router is power Asus RT-AX86U Pro)

So, how is the Asus box connected to the Internet? Does its WAN port plug into the exact same port as you are connecting the pfSense WAN connection to? Is there perhaps a switch that both are plugging in to for connection to your ISP?

I am going to assume that English is not your native language because the way you are structuring your sentences and using words is quite confusing to me, especially with you seeming to switch back and forth talking one minute about wired and the next about wireless. I don't believe I am understanding your problem fully.

Antibiotic

@bmeeks Yep English not my native))) Connection going in this way: ISP cable to WAN of pfSense box than switch TL-SG108E to LAN of pfSense box. The rest home network connected over this switch as well AP router.

Antibiotic

@bmeeks The main question was is this NIC model support all these 3 options
(if any on forum have these cards and can confirmed) and possible to keep them during traffic shaping?

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks Yep English not my native))) Connection going in this way: ISP cable to WAN of pfSense box than switch TL-SG108E to LAN of pfSense box. The rest home network connected over this switch as well AP router.

Okay, so all traffic (both wired and wireless) takes the same path through pfSense.

Now let's turn to what your problem is. Is your complaint that you are not seeing full ISP speed through pfSense ever, or only when you enable Snort (does the speed drop).

Where are your measuring speed? Be aware that you should not put a speedtest client on pfSense itself as servicing that application takes CPU cycles away from routing packets and will adversely impact the speedtest measurement. You should only test "through" pfSense by utilizing a speed test client on a machine in your LAN testing to a destination on the Internet. The traffic will pass through pfSense in that scenario but will not be "sourced/created" by pfSense and thus won't bog down routing by stealing CPU cycles.

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks The main question was is this NIC model support all these 3 options
(if any on forum have these cards and can confirmed) and possible to keep them during traffic shaping?

I don't know. That is something you will have to research for the specific NIC model and firmware revision you have. There are multiple variations of that card and driver available now from Intel.

For symmetrical connections (where upload and download speeds are the same), traffic shaping is not as big of a deal as it is on asymmetrical connections where upload is much slower than download. Why do you want to use traffic shaping?

Antibiotic

@bmeeks Traffic shaping for my experience in pfSense , one more question can you tell me FreeBSD command to check specific NIC model and firmware revision in terminal?

Antibiotic

@bmeeks This one got from command:
igc0@pci0:1:0:0: class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x 125c subvendor=0x8086 subdevice=0x0000
vendor = 'Intel Corporation'
device = 'Ethernet Controller I226-V'
class = network
subclass = ethernet

Can you please tell me, where can check by this info NIC support options?

bmeeks

@Antibiotic said in Intel NIC I-226V:

@bmeeks This one got from command:
igc0@pci0:1:0:0: class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x 125c subvendor=0x8086 subdevice=0x0000
vendor = 'Intel Corporation'
device = 'Ethernet Controller I226-V'
class = network
subclass = ethernet

Can you please tell me, where can check by this info NIC support options?

Here is where the driver for that hardware family was introduced into FreeBSD and thus pfSense (both the i225 and i226 are the same NIC family): https://cgit.freebsd.org/src/commit/?id=d7388d33b4dd. If you look through the git diff you can find the man page showing the supported tunables.

stephenw10

You can see what the driver/hardware is reporting as capable like:

[24.03-BETA][admin@4200.stevew.lan]/root: ifconfig -vvm igc0
igc0: flags=1008843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST,LOWER_UP> metric 0 mtu 1500
	options=48020b8<VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,WOL_MAGIC,HWSTATS,MEXTPG>
	capabilities=4f43fbb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,WOL_UCAST,WOL_MCAST,WOL_MAGIC,VLAN_HWTSO,NETMAP,RXCSUM_IPV6,TXCSUM_IPV6,HWSTATS,MEXTPG>
	ether 00:08:a2:12:ec:d4
	media: Ethernet autoselect
	status: no carrier
	supported media:
		media autoselect
		media 2500Base-T
		media 1000baseT
		media 1000baseT mediaopt full-duplex
		media 100baseTX mediaopt full-duplex
		media 100baseTX
		media 10baseT/UTP mediaopt full-duplex
		media 10baseT/UTP
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
	drivername: igc0

That is the same NIC in the 4200:

[24.03-BETA][admin@4200.stevew.lan]/root: pciconf -lv igc0
igc0@pci0:25:0:0:	class=0x020000 rev=0x04 hdr=0x00 vendor=0x8086 device=0x125c subvendor=0x8086 subdevice=0x0000
    vendor     = 'Intel Corporation'
    device     = 'Ethernet Controller I226-V'
    class      = network
    subclass   = ethernet

Antibiotic

@stephenw10 Ok, thank's

Antibiotic

@stephenw10 But actually, is it normally in case of working suricata, crowdsec and traffic shaping limiters (up to 95% of max capacity in Limiters) my ISP speed going down to 60%/70% of max capacity ( 1GB Up/Down)?

stephenw10

No.
However what is seemingly quite common with those N100/N200 CPUs is the speed/power values passed by the BIOS result in slow running. Check the CPU frequency reported during the test.

Antibiotic

@stephenw10 during speed test result:
Intel(R) N100
Current: 2922 MHz, Max: 806 MHz
4 CPUs: 1 package(s) x 4 core(s)
AES-NI CPU Crypto: Yes (active)

Antibiotic

@stephenw10 Power Savings - Intel Speed Shift
Speed ShiftEnable Speed Shift

Current State: Active
Control Level
Core Level Control (Recommended)

Core-level control is the best practice in most cases, especially for hardware with only a single physical CPU. Changing this setting requires a reboot.

Current Active Level: Core
Power PreferencePerformanceEnergy Efficiency
50

stephenw10

Mmm, OK. That seems good.
I'd also try runing top -HaSP whist testing to see the per core CPU load at the time.