Hardware Sizing & Throughput Considerations



  • All,
    I need some clarity on Hardware Sizing & Throughput Considerations mentioned in this link ..

    http://www.pfsense.org/index.php?option=com_content&task=view&id=52&Itemid=49

    When it's said "10-20 Mbps - No less than 266 MHz CPU"

    1. does the 10-20Mbps mean 10-20Mbps Mbps of throughput from WAN to LAN and LAN to WAN only? OR
    2. does it also mean internal LAN throughput between LAN machines and network devices?

    I see a lot of Atom processor based pfsense hardware. How does that affect data transfer speeds within the LAN?

    The reason I ask this is coz I have an Intel i3/4GB based mini-itx system and 30/4 cable internet. Extremely heavy internal network activity with 4 VLANs and internet traffic is maxed pretty much the entire time with online movies, online backups, etc. with about 30 users at any given time. The only time I see the processor going up to 10% is when there is internet data coming in through WAN or data going out to the internet. Internal gigabit network is practically maxed all the time but the internal activity doesn't show up on the traffic graph dash. Also the processor isin't hard at work ever.

    Also, I am running resource intensive Snort, HAVP, Squid, SquidGuard & LightSquid across all VLANs. Memory consumption goes higher every day due to a lot of internet activity and Snort/Squid being at work that.

    Is my i3 based hardware a bit too powerful? My earlier thoughts about throughput were that I needed better processor to sustain internal gigabit network rather than the 30/4 WAN bandwidth.



  • Throughput means (as the name say) traffic going through the device.

    –> Your option 1)

    Traffic on your LAN between your LAN devices never goes over the router since the clients can reach each other directly.

    Yes your i3 might be a bit overpowered.
    However since you're running a lot of packages it might be better in the long run.
    With all these packages active just make sure you have enough RAM.
    I'd say 4GB is the lower limit.



  • Darn !! waste of $$$ there. $400 to the precise. To top it all, I sold off the i3 to friend (well made money there) and got more powerful i5-2500 Sandy Bridge.

    Now, I am thinking is it worth to keep an i5 as a pfsense router? Any suggestions?

    My current config…

    Intel® Core™ i5-2500K Processor (6M Cache, 3.30 GHz)
    4GB RAM
    Gigabyte GA-H67N-USB3-B3 (mini-ITX)
    Intel gigabit (dual port)
    Thermaltake Power Supply Mini Case Mini ITX 200 VL52021N2U



  • Well i wouldn't call it a waste, but more an investment ;)

    If you ever want a VPN you'll like the i3/5 since this is pretty CPU intensive load.



  • With that hardware you could have somewhere near 30/4 all vpn trafic with snort+squid on top of it


  • Netgate Administrator

    With that hardware you're probably set for the next 10 years!  ::)
    When your cable company offers you a 10G connection you may have to upgrade.  :D

    I would expect VLAN traffic to show up the appropriate traffic graph. It seems odd that it wouldn't.
    If you have WAN and then several VLANs to separate your internal network you should be able to see traffic from one VLAN to another one going through your pfSense box. This is often a problem if you need maximum throughput since all the VLANs are connected through one NIC with a limited bandwidth.
    The fact that your not seeing any traffic might imply that the VLANs aren't setup correctly and can communicate directly.

    Steve



  • Maybe i can make it a good hacintosh.

    Steve,
    The only traffic I see on the dash is WAN to VLAN and VLAN to WAN. Is there any documentation on VLAN?



  • Vlan in general is well documented just use search engines
    Vlan in pfsense? what you want to know it?
    pfsense wiki



  • I started a new thread for VLAN here..

    http://forum.pfsense.org/index.php/topic,39833.0.html



  • @asterix:

    The only traffic I see on the dash is WAN to VLAN and VLAN to WAN. Is there any documentation on VLAN?

    Are you expecting to see VLAN to VLAN traffic show up on pfSense? In many cases VLAN to VLAN traffic is handled entirely within the switch and doesn't get to  the router.



  • Yes, that is what I am suspecting.



  • Can anyone recommend a good Atom based passively cooled motherboard with the fastest Atom dual core processor. Dual gigabit with 8GB RAM support preferred but not a critical requirement.


  • Netgate Administrator

    @wallabybob:

    Are you expecting to see VLAN to VLAN traffic show up on pfSense? In many cases VLAN to VLAN traffic is handled entirely within the switch and doesn't get to  the router.

    I'm not actually running any VLANs at the moment so I can't check but if the VLANs are assigned as different interfaces in pfSense then I would expect any traffic between them to have to go through pfSense?
    If traffic is bypassing pfSense and being routed by the switch then that's a big security hole! No?

    Steve



  • That's what i thought first as well.
    However i think he means with VLAN to VLAN traffic actually traffic within a single VLAN.
    At least it's formulated like this in the other thread.
    http://forum.pfsense.org/index.php/topic,39833.0.html


  • Netgate Administrator

    Ah! I see.

    Steve



  • Yes, I took the question as VLAN traffic to same VLAN.



  • @asterix:

    Can anyone recommend a good Atom based passively cooled motherboard with the fastest Atom dual core processor. Dual gigabit with 8GB RAM support preferred but not a critical requirement.

    Not sure if such a thing even exists.
    The closest thing i currently see is this: http://www.fit-pc.com/web/fit-pc2/fit-pc2i-specifications/
    (only 1 core and quite expensive at that….)
    I have one to play around and get about 600Mbit throughput.
    Or in the future: http://www.fit-pc.com/fit-pc3/ (not yet out).


  • Netgate Administrator

    Yep, I don't think you'll find an Atom chipset that supports 8GB.

    Steve



  • The i3's support 8GB and you can get them down to near Atom power levels.  The hard part is finding the power supply in my experience.

    http://www.tomshardware.com/reviews/d510mo-intel-atom,2616-11.html

    My i3 with an ATX board and 3 PCI NICs idles at 40W, but that's with a 430W PSU.


  • Netgate Administrator

    The graphs at that link are quite revealing. Those desktop Atoms have no powersaving features. Look at the D510, 28W at 0 load, 33W at 100% load.  :o The Netbook atoms are much better <10W at idle.

    Steve



  • fit PC is overrated and extremely expensive for the hardware config.

    Yes I realized 8GB is not achievable for Atom mobo's yet. Which is the best Atom mobo with the fastest Atom processor that I can get right now? I may switch to FTTH in the coming months and would definitely need good WAN to LAN throughput.

    How can I get the power down for the i5 Sandy Bridge I have right now? The thermaltake enclosure has zero air circulation and my processor runs 62C at idle times.. yeah I know it's hot. To make matters worse the PSU is almost touching the processor.. it's that close.. so a lot of heat is generated and no fans except of the PSU which is a joke. I even removed the stock thermal paste, got the expensive $15 CPU thermal paste from Staples and reapplied a good thin layer. But the that has not changed the temperature by even a degree. Tried cleaning and reapplying thrice but no change.

    I need to get the power consumption on this down and maybe it will cool itself a bit.


  • Netgate Administrator

    Have you enabled powerd?

    Steve



  • Yes. It tries to bring down the the processor to about 400 but it's not constant. Thinking about lowering the CPU and RAM power in the BIOS.

    Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
    Current: 400 MHz, Max: 3601 MHz



  • You could find also next opportunity: Diagnostics:Command prompt, run```
    sysctl -a | grep cpu

    then you should find next kind text```
    dev.cpu.0.freq: 3000
    

    Then you can go to /boot/loader.conf.local and create a line with a smaller frequency, like 200.


  • Netgate Administrator

    Powerd should take care of all that for you. It depends which driver it's using though. It's only really effective when it uses a driver that can scale back the voltage as well as frequency. I'm not sure FreeBSD will have caught up with i5 yet.

    Steve



  • @stephenw10:

    The graphs at that link are quite revealing. Those desktop Atoms have no powersaving features. Look at the D510, 28W at 0 load, 33W at 100% load.  :o The Netbook atoms are much better <10W at idle.

    Steve

    Yeah, for some reason they didn't include speedstep in the desktop versions, so they run at full power all the time.  It's another reason I went with the i3 instead.


  • Netgate Administrator

    @Bai:

    It's another reason I went with the i3 instead.

    Good choice!  :)
    It must have been a marketing decision. To differentiate between the two cpus. Same as Pentium-M vs Celeron-M.

    Steve



  • I undervolted everything on the CPU a couple of days back. It has bought down my idle CPU temperature from 60C to 55C. The enclosure is much less warm than before. Undervolting the CPU hasn't impacted performance, though the CPU runs around 15 to 20% on heavy downloads. Glad it's working without problems till now.

    Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz
    Current: 200 MHz, Max: 1600 MHz

    Speed bumps from 200/400 to 800/1200 frequently, Powerd in action?

    Should I undervolt the RAM too? If yes, will that impact the performance? Bumping my 4GB RAM to 8GB this week.. need it for Snort and Squid.


  • Netgate Administrator

    I take it you are manually undervolting in the bios?
    This usually only leads to instability. There will be some room for adjustment as the recommended voltage will be well within the tolerance on the cpu. If, say, you keep adjusting the voltage down what will happen is that you will reach a level at which the CPU starts making calculation errors at it's maximum frequency. The trouble is that with powerd enabled and such a fast cpu it will hardly ever run at maximum frequency.
    If you are serious about reducing the voltage you need to run a stress test on the cpu to ensure it's stable.
    Undervolting the ram will make almost no difference to power consumption or cpu temperature, I wouldn't bother.
    Does your i5 have any speedstep like powersaving modes? I haven't looked into it.

    Steve



  • Yes, I did the undervolting from the BIOS. Set the lowest possible value for all CPU settings along with the multiplier. Don't think pfSense can put this CPU into any kind of decent stress unless I have a Gigabit WAN bandwidth.. lol.

    Do you recommend I switch back to the original BIOS settings and let powerd do the job?


  • Netgate Administrator

    It depends what powerd is doing, which depends on what driver it's using to control the cpu. Generally speaking using some sort of dynamic frequency/voltage control, like powerd, is a much better solution since it still gives you access to higher cpu powers if you need them.
    Here are some results I had when testing my own box, a Pentium-M with enhanced speedstep.

    
    [2.0-BETA4][root@pfSense.localdomain]/root(12): sysctl dev.cpu.0.freq=1500
    dev.cpu.0.freq: 600 -> 1500
    [2.0-BETA4][root@pfSense.localdomain]/root(13): mbmon
    ioctl(smb0:open): No such file or directory
    
    Temp.= 25.0, 32.0,  0.0; Rot.= 10384, 10546, 9375
    Vcore = 1.33, 2.13; Volt. = 3.39, 5.13, 12.40, -12.28, -2.13
    
    [2.0-BETA4][root@pfSense.localdomain]/root(14): sysctl dev.cpu.0.freq=600
    dev.cpu.0.freq: 1500 -> 600
    [2.0-BETA4][root@pfSense.localdomain]/root(15): mbmon
    ioctl(smb0:open): No such file or directory
    
    Temp.= 25.0, 31.0,  0.0; Rot.= 10384, 10384, 9375
    Vcore = 0.96, 2.08; Volt. = 3.39, 5.13, 12.40, -12.28, -2.13
    
    [2.0-BETA4][root@pfSense.localdomain]/root(10): sysctl dev.cpu.0.freq_levels
    dev.cpu.0.freq_levels: 1500/-1 1200/-1 1000/-1 800/-1 600/-1
    
    

    The cpu voltage is dropped a lot but only at low frequencies. See here for more details.
    There are a number of packages available in FreeBSD to load the CPU, I used cpuburn.

    Steve



  • @stephenw10:

    @Bai:

    It's another reason I went with the i3 instead.

    Good choice!  :)
    It must have been a marketing decision. To differentiate between the two cpus. Same as Pentium-M vs Celeron-M.

    Steve

    Well, it'd be a better choice if I could find a power supply smaller than 400W.  I'm using a 430W I had laying around, but it's way overkill for the machine.



  • So I increased my bandwidth this week to 50/8. The entire bandwidth is hogged up by users who are really excited with the extra speed. I see my CPU take a beating since I lowered it's voltage down to a 1600Mhz. Thinking about switching it back to defaults and let Powerd handle the frequency.

    Any suggestions?


Locked