Help needed with performance tuning with Verizon FIOS..

stephenw10

We aren't seeing many errors at the NICs..

[2.0.2-RELEASE][admin@pfSense.localdomain]/root(3): netstat -I ue0
Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll
ue0 1500 <link#9>00:10:60:dd:cc:0a 45306 1952 0 40413 0 0</link#9>

I disagree. You seem to be showing quite a lot of errors on ue0. Stats from one of my NICs here:


[2.0.2-RELEASE][root@pfsense.fire.box]/root(2): netstat -I em1
Name               Mtu Network       Address              Ipkts Ierrs Idrop    Opkts Oerrs  Coll
em1               1500 <link#2>00:90:7f:32:4f:ee  6090864     0     0  8029860     0     0
em1               1500 192.168.2.0   192.168.2.1          60062     -     -   710736     -     -
em1               1500 fe80:2::290:7 fe80:2::290:7fff:        0     -     -        0     -     -</link#2>

USB NICs are almost always bad performers.

Steve

wxfield

Hmm..I didn't really think that was a large enough qty for concern.. Ok Stephen, Thanks!

We chose that particular device due to the fact it was on the supported list:
http://www.freebsd.org/releases/8.1R/hardware.html#ETHERNET

I've just learned that "supported" doesn't mean the same thing to me as it does to pfSense. ;-)

I don't mind changing NICs, I just wish I didn't have to play trial & error with my wallet.

Any ideas on where I can get a listing of truly supported NIC's and some performance stats from users? It'd be a pretty handy list to maintain on these forums I would think..given so many postings expressing the same frustrations.

stephenw10

I'm sorry about that. :(
Had you asked I'm sure people would have advised you not get a USB NIC. I know there are people using them with no problems though so you could just be unlucky. You could try a different USB port, some older hardware has a mix or USB1 and USB2 ports. I really wouldn't expect any errors on a wired NIC, pehaps a few if the cable is removed. Try a different cable.
Here are the stats for my wifi NIC where there are many more errors, to be expected on wifi in a congested area:

[2.0.2-RELEASE][root@pfsense.fire.box]/root(1): netstat -I ath0
Name               Mtu Network       Address              Ipkts Ierrs Idrop    Opkts Oerrs  Coll
ath0              2290 <link#4>00:11:f5:ee:42:9c  3829362 285387     0  4331435     6     0</link#4>

In general Intel NICs are best supported under FreeBSD and hence pfSense. What is the rest of your hardware?

Steve

wallabybob

@wxfield:

Any ideas on where I can get a listing of truly supported NIC's and some performance stats from users? It'd be a pretty handy list to maintain on these forums I would think..given so many postings expressing the same frustrations.

What are your constraints? What expansion ports do you have available?

What do mean by truly supported? You haven't responded to my point about USB speed so the following example may not be relevant. "Supported" can never mean "performs the impossible" such as sucking 20Mbps through a 12Mbps pipe.

wxfield

Stephen -

Meh..no need to be sorry, just trying to find the right fit for our network and firewall. DD-WRT is "ok", but their cheap NICs built into ~$75 routers don't hold up well. And whatever eeprom devices they use for image storage don't seem to have very many read cycles in them either. I have a small pile of them to prove it.

Most of my pfSense hardware has been pieced together from sundry spare parts, an old motherboard for example. I will try several PCI Intel cards and one PCI-X card that I can borrow from a friend on Monday. I was simply giving what I had easily accessible on hand a try. If the Intel cards work out I may either buy them from him or search out the same controllers online.

It'd still be good to know what cards routinely have performed the best for people in their builds and what kind of throughput they are pushing through their cards. A moderated wiki-fied matrix might be useful..just a thought. It would certainly be a great resource for people trying pfSense for the first time..and probably avoid a lot of "what's up with my performance?" type questions to the forums. :-)

stephenw10

There is this which basically says what I did:
http://doc.pfsense.org/index.php/Hardware_requirements#Network_Card_Selection
The hardware examples given there are a bit outdated now though.

Perhaps unsurprisingly a number of people have suggested some sort of wiki. It's tough to get firm numbers without a single person (or group) doing some identical testing. No one has volunteered to do that yet. ;)

Steve

wxfield

Hi Steve,

So here's some validation for you.. ;-)

While I was watching the Patriots cream the Texans my friend with the NIC cards stopped by. Since he lives nearby I agreed to share the ribs I made in trade for the Intel cards he had. I was just joking..but he was off and 10 mins later brought the cards to me. A somewhat different result with the PCI and PCI-X cards..

em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=4209b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic,vlan_hwtso>ether 00:1d:ba:8e:83:87
inet6 fe80::21b:21ff:fe6c:2eb%em0 prefixlen 64 scopeid 0x1
inet 96.233.38.12 netmask 0xffffff00 broadcast 96.233.38.255
nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>)
status: active
em2: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
options=209b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic>ether 00:1b:21:6e:aa:5f
inet6 fe80::21b:21ff:fe6e:aa5f%em2 prefixlen 64 scopeid 0x2
inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
nd6 options=43 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
status: active

netstat -I em0
Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll
em0 1500 <link#1> 00:1d:ba:8e:83:87 20671 0 0 11975 0 0
em0 1500 fe80:1::21b:2 fe80:1::21b:21ff: 0 - - 1 - -
em0 1500 96.233.38.0 pool-96-233-38-12 973 - - 623 - -

netstat -I em2
Name Mtu Network Address Ipkts Ierrs Idrop Opkts Oerrs Coll
em2 1500 <link#2> 00:1b:21:6e:aa:5f 23312 0 0 29764 0 0
em2 1500 fe80:2::21b:2 fe80:2::21b:21ff: 0 - - 1 - -
em2 1500 192.168.1.0 pfSense 10492 - - 8101 - -

The speedtest.net aren't exactly 20M/5M..but it's a heck of a lot better now.

![Screen Shot 2013-01-14 at 12.35.14 AM.png](/public/imported_attachments/1/Screen Shot 2013-01-14 at 12.35.14 AM.png)
![Screen Shot 2013-01-14 at 12.35.14 AM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-01-14 at 12.35.14 AM.png_thumb)</link#2></link#1></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum,wol_magic,vlan_hwtso></up,broadcast,running,simplex,multicast>

stephenw10

Good result.
I hope you gave him some ribs! ;)

Steve

wxfield

Steve,

Sure did..he ate them up like there was no tomorrow.

Invited himself over for the Ravens v Patriots game too..so long as I make more ribs. :-)

So how do I go about getting the pfSense guys to host that wiki we were talking about..Ideas?

-Warren

stephenw10

I would suggest the first thing is to agree on a test procedure that will give a useful result. It has to be relatively easy to test to get a good number of people producing numbers. It also has to give results that are meaningful to users (not 'I can get 800Mbps if I use jumbo frames across a 4 NIC LAGG').
Then setup a forum thread where people can post results. Finally ask for edit rights on the wiki and setup a page describing the above. ;)

A good example of some great testing is here: http://forum.pfsense.org/index.php/topic,27780.0.html

Speak to Jim (jimp) and/or Chris (cmb) who will have a better idea about this than me!

Steve