Low throughput



  • Hi guys

    I've bought this decent machine: http://www.aliexpress.com/item/Educational-router-firewall-server-fanless-firewall-pc-with-4-82583V-Gigabit-Ethernet-4G-RAM-32G-SSD/32242293349.html

    Now I got an fiber line with 1Gbit/s down- and upload - pretty nice. But on speedtests I "only" got 540 Mpbs download speed and 250 Mpbs (plus/minus a bit).

    I checked some guides, also the https://doc.pfsense.org/index.php/Low_Throughput_Troubleshooting, but it didn't helped. I got 4 Intel 82583V Gigabit NICs onboard and an Atom D2550 1.86 GHz, 4GB Ram and 32 GB SSD on it. I can't see any hardware limitations on the diagnostic page.

    Does anyone have a hint where the bottle neck could be? I can't find it…

    Before I tried an pcengines apu4 and got about 400 Mpbs down- and upload with the exactly same config...

    Thanks so much for any help in advance,
    p@sco

    EDIT:  I've just tried to run a fresh install of pfsense. I get then around 540 Mpbs download and 540 Mpbs upload...strange. So there must be something in my (old) config that lowers the upload. But still, I don't get the +920 Mpbs I'm looking for..

    EDIT2: I'm using a TP-Link MC220L Mediaconverter..I hope this thing is not the bottle neck :-)



  • A  1.86ghz Atom CPU is not going to be a very powerful software firewall. We're not quite at the point where $300 for a software firewall that can move 1Gb/s of a single flow.

    Check System Activity. I could be wrong, but I suspect very high cpu usage under load.



  • Hmm, my system activity log looks like that while I'm at speedtest…looks like there is plenty of free resources or am I wrong?

    last pid: 86067;  load averages:  0.09,  0.04,  0.01  up 0+23:01:26    20:52:07
    160 processes: 5 running, 133 sleeping, 22 waiting

    Mem: 16M Active, 80M Inact, 187M Wired, 30M Buf, 3643M Free
    Swap: 8192M Total, 8192M Free

    PID USERNAME PRI NICE  SIZE    RES STATE  C  TIME    WCPU COMMAND
      11 root    155 ki31    0K    64K RUN    1  22.9H 100.00% [idle{idle: cpu1}]
      11 root    155 ki31    0K    64K CPU3    3  22.9H 100.00% [idle{idle: cpu3}]
      11 root    155 ki31    0K    64K CPU2    2  22.9H  93.16% [idle{idle: cpu2}]
      11 root    155 ki31    0K    64K CPU0    0  22.8H  80.66% [idle{idle: cpu0}]
        0 root    -92    -    0K  288K -      2  4:07  21.78% [kernel{em0 que}]
        0 root    -92    -    0K  288K -      2  2:03  14.06% [kernel{em1 que}]
    30093 root      29    0  262M 31748K piperd  1  0:02  3.08% php-fpm: pool nginx (php-fpm)
      12 root    -60    -    0K  352K WAIT    3  2:56  0.00% [intr{swi4: clock}]
        5 root    -16    -    0K    16K pftm    0  0:46  0.00% [pf purge]
        0 root    -16    -    0K  288K swapin  1  0:37  0.00% [kernel{swapper}]
    17180 root      52  20 17000K  2568K wait    1  0:30  0.00% /bin/sh /var/db/rrd/updaterrd.sh
      15 root    -16    -    0K    16K -      2  0:13  0.00% [rand_harvestq]
    25159 dhcpd    20    0 24804K 13520K select  0  0:08  0.00% /usr/local/sbin/dhcpd -user dhcpd -group _
    40654 root      20    0 30140K 17968K select  2  0:06  0.00% /usr/local/sbin/ntpd -g -c /var/etc/ntpd.c
    44165 root      20    0 14516K  2316K select  3  0:05  0.00% /usr/sbin/syslogd -s -c -c -l /var/dhcpd/v
    31924 root      20    0 46196K  7984K kqread  3  0:05  0.00% nginx: worker process (nginx)
      12 root    -72    -    0K  352K WAIT    1  0:05  0.00% [intr{swi1: netisr 1}]
      21 root      16    -    0K    16K syncer  3  0:04  0.00% [syncer]

    Thanks
    P@sco



  • I have a different version, but that same chip. I could never break 550Mbps. As Harvy66 suspects, if you watch the CPU graph as you try and push 1Gbps, it spikes to 100%.



  • Now I got an fiber line with 1Gbit/s down- and upload - pretty nice. But on speedtests I "only" got 540 Mpbs download speed and 250 Mpbs (plus/minus a bit).

    Let us please talk about the testing procedure, what is coming out if you are taking iPerf and in front of the
    WAN interface (over a switch) is acting as a server and behind the LAN interface will be one PC acting as a
    iPerf client? Only doing a speed test over the Internet is not really a test you can count on and other will be
    able to reproduce it again.

    I checked some guides, also the https://doc.pfsense.org/index.php/Low_Throughput_Troubleshooting, but it didn't helped.

    You should be perhaps better to go with reading that announcement from pfsense first, its about the
    needed hardware minimum to archive several MBit/s throughput at the WAN interface. Link
    Under that link you will be able to find this statement about throughput arching:
    10-20 Mbps We recommend a modern (less than 4 year old) Intel or AMD CPU clocked at at least 500MHz.
    21-100 Mbps We recommend a modern 1.0 GHz Intel or AMD CPU.
    101-500 Mbps No less than a modern Intel or AMD CPU clocked at 2.0 GHz. Server class hardware
    with PCI-e network adapters, or newer desktop hardware with PCI-e network adapters.
    501+ Mbps Multiple cores at > 2.0GHz are required. Server class hardware with PCI-e network adapters.

    I got 4 Intel 82583V Gigabit NICs onboard and an Atom D2550 1.86 GHz, 4GB Ram and 32 GB SSD on it. I can't see any hardware limitations on the diagnostic page.

    Please read the lines above.

    Does anyone have a hint where the bottle neck could be? I can't find it…

    Intel lower end Atoms, several years old would do perhaps a good job but are not the strongest ones too.

    Before I tried an pcengines apu4 and got about 400 Mpbs down- and upload with the exactly same config…

    read the lines above again please.



  • Thanks for your answers.

    I have a different version, but that same chip. I could never break 550Mbps. As Harvy66 suspects, if you watch the CPU graph as you try and push 1Gbps, it spikes to 100%.

    So I probably have too little cpu power, even though I couldn't see the cpu power was used 100% while I was trying to push 1 Gpbs.

    Let us please talk about the testing procedure, what is coming out if you are taking iPerf and in front of the
    WAN interface (over a switch) is acting as a server and behind the LAN interface will be one PC acting as a
    iPerf client? Only doing a speed test over the Internet is not really a test you can count on and other will be
    able to reproduce it again.

    I will have a test with iPerf as you described. I tested it with a speedtest-Server at my ISP.

    101-500 Mbps  No less than a modern Intel or AMD CPU clocked at 2.0 GHz. Server class hardware
    with PCI-e network adapters, or newer desktop hardware with PCI-e network adapters.
    501+ Mbps  Multiple cores at > 2.0GHz are required. Server class hardware with PCI-e network adapters.

    So I will get something stronger, with more CPU power and server class hardware.

    Cheers
    P@sco



  • Those recommendations are ancient. You definitely don't need server-class hardware. Any modern Atom will push 1Gbps as long as that is all it is doing - i.e. you're not asking it to perform Snort IDS or OpenVPN at 1Gbps also. Try to find something with Intel QuickAssist, like the Atom C23xx series.

    pfSense sells a official router that uses a C2358 Dual Core 1.7GHz Atom (we have one and can push 1Gbps with it) - but as you can see, in the reviews, others say they can also. It's fanless too.

    https://store.pfsense.org/SG-2440/


Log in to reply