Subject: perfomance comparison

From: "gis88530" <[email-masked]>
Date: Fri, 2 Mar 2001 15:49:47 +0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello,
    I have construct the following environment, where squid use
    cache_peer to redirect http request to tis. Thanks GOD. It works.

    (webstone)------(squid<-->tis)------(web server)

    When I use webstone to measure the performance of following two
    environments, I found the performance of second environment is 
    very BAD. Could you give me a hand ? I don't know why.

    1:    (webstone)------(PC router)------(web server)
        throughput: 43.18 Mbps
        response time: 0.003 sec
        connection rate: 284.98 conn/sec 

    2:    (webstone)------(squid<-->tis)------(web server)
        throughput: 4.37 Mbps
        response time: 0.034 sec
        connection rate: 28.06 conn/sec

Steven

---

From: Tony Gale <[email-masked]>
Date: Fri, 02 Mar 2001 09:28:40 -0000 (GMT)

Could you also try

(webstone) ---- (squid) ---- (web server)

and

(webstone) ---- (fwtk) ---- (web server)

The fwtk isn't renowned for it's performance. Are you running squid
and fwtk on the same box? If so, that will kill your performance.

-tony

>         connection rate: 28.06 conn/sec

---
E-Mail: Tony Gale <[email-masked]>
Who's on first?

The views expressed above are entirely those of the writer
and do not represent the views, policy or understanding of
any other person or official body.

---

From: Antuan Avdioukhine <[email-masked]>
Date: Fri, 2 Mar 2001 13:22:17 +0300 (MSK)

>         connection rate: 28.06 conn/sec
	It is quite simple I guess. PC router (or HW router) just forwards
packets and maybe checks IP header when filtering is active. squid/httpgw
og squid-gw makes application specific analysis of HTML code. If webstone
makes connections serially, it would detect dramatical perfomance
decrease.

--
Antuan Avdioukhine (DEKA-RIPN)
InternetMedia Holding Ltd.
St.Petersburg, Russia. +7 (812) 320 8585

---

From: "gis88530" <[email-masked]>
Date: Fri, 2 Mar 2001 18:49:15 +0800

Hello,
    Thanks.
    I have try following conditions, 
    (The squid only condition doesn't work, because 
    webstone will hang to retrieve html pages)

    1:    (webstone)----(fwtk)----(web server)
        throughput: 0.34 Mbps
        response time: 0.023 sec
        connection rate: 42.62 conn/sec

    2:    (webstone)------(PC router)------(web server)
        throughput: 43.18 Mbps
        response time: 0.003 sec
        connection rate: 284.98 conn/sec 
 
    3:    (webstone)------(squid<-->tis)------(web server)
        throughput: 4.37 Mbps
        response time: 0.034 sec
        connection rate: 28.06 conn/sec

    I am wondering the performance of tis.
    Could you give me some hints ?
    Maybe we can improve it.
    Thanks for disscussion.

Steven

---

From: Tony Gale <[email-masked]>
Date: Fri, 02 Mar 2001 11:07:15 -0000 (GMT)

>     webstone will hang to retrieve html pages)

I don't understand what the problem is - is it a problem with
webstone?

>     Could you give me some hints ?

There's no easy solution to improve the performance of the FWTK. It's
design really isn't up to it. It fork()'s a new process for each
connection, doesn't support any kind of presistent connections and
its logging will kill your performance unless you set it up right.
I'm also not convinced by its html checking.

Don't get me wrong, I like it, and it has served me well over many
years. You just have to be aware of its limitations. I use multiple
proxy servers, for example.

BTW, on the subject of logging, did you have the fwtk logging through
syslog in your tests? If so, turn that off to see what difference it
makes - I don't know what system you are using, but you may also want
to try if after turning off sync'ing in your syslog.conf

-tony

---
E-Mail: Tony Gale <[email-masked]>
Recent research has tended to show that the Abominable No-Man
is being replaced by the Prohibitive Procrastinator.
		-- C.N. Parkinson

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 02 Mar 2001 10:28:59 +0100

>         connection rate: 28.06 conn/sec

It's hard to tell without knwing more precisely what you do. "squid use
cache_peer to redirect http request to tis" is extremely vague. Is squid
configured as proxy only, or does it do http caching too? What do you
mean by "tis", http-gw or plug-gw? What is there in your netperm-table?
Is the TIS proxy started from inetd or with -daemon from rc?

In any case, application-level proxies will *never* be as fast as packet
filters, since the former will fork and/or exec new process(es) for
every connection (1 to accept, one for netacl if used, maybe 1 fork in
squid unless it's thread-based, I don't know squid well enough).

If you really want 200+ connections per second, and you don't need any
functionality that requires understanding of the protocol, you can use
some form of *filtered* packet forwarding, eg on Linux ipfwadm, ipchains
or iptable.

For 200+ conn/sec *and* application-level proxying, IMHO you will need a
ton of hardware, or some thread-based proxy, most probably commercial
and expensive.

Greetings.
-- 
Michel Bardiaux

---

From: "gis88530" <[email-masked]>
Date: Sat, 3 Mar 2001 00:11:21 +0800

Sorry,
    I just use http-gw, and there are many
    log in /var/log/messages.

    Maybe my configurations are WRONG.
    Could you give me a hand?
    My netperm-table is as follows:

http-gw: permit-hosts 140.113.113.153 192.168.100.254 127.0.0.1
192.168.100.* -nojava -nojavascript -noactivex

Steven

---

From: Tony Gale <[email-masked]>
Date: Fri, 02 Mar 2001 17:09:43 -0000 (GMT)

By default the FWTK logs to syslog. Syslog will sync your disks after
*every* message. Fine if you want to guarantee that you log every
message in case of a crash, but it kills your performance, especially
on something that logs as much as the FWTK (and it logs too much,
IMHO). So, for testing purposes, I would re-run your tests having
first commented out the appropriate line in /etc/syslog.conf, and
sending syslog a HUP signal (kill -HUP <pid of syslog>) such that
nothing from the FWTK gets logged.

I would then re-run the tests again, with the logging, but with the
sync'ing turned off. You do that by adding a '-' to the approproiate
entry in /etc/syslog.conf, so for example:

*.info;mail.none;authpriv.none                     /var/log/messages

becomes

*.info;mail.none;authpriv.none                     -/var/log/messages

(be careful not to break the tabbing between these two entries -
syslog won't work if you do)

You may won't to check your syslog.conf man page to see that it
supports the no sync'ing option.

-tony

---
E-Mail: Tony Gale <[email-masked]>
flannister, n.:
	The plastic yoke that holds a six-pack of beer together.
		-- "Sniglets", Rich Hall & Friends

---

From: David Lang <[email-masked]>
Date: Fri, 2 Mar 2001 10:20:05 -0800 (PST)

also the OS you are useing can make a HUGE difference. I ran some tests a
couple months ago for one firewall we were looking at putting in.

that firewall was running 1300 plug-gw proxies (different ports)

on Linux 2.2.x (after recompiling to raise the max procs) I was seeing
~50% CPU at ~30 connections/sec

on Linux 2.4.0pre11 I was seeing ~20% CPU on ~300 connections/sec

System was 950MHz Athlon 512MB PC133 Ram

shutting down syslog entirly appeared to make no significant diffence to
these numbers. I ended up configuring the machine to syslog out the serial
port to another machine (I did tweak the code to not log quite as much as
it normally does)

David Lang

On Fri, 2 Mar 2001, Tony Gale wrote:

> Date: Fri, 02 Mar 2001 17:09:43 -0000 (GMT)
> From: Tony Gale <[email-masked]>
> To: gis88530 <[email-masked]>
> Cc: fwtk <[email-masked]>
> Subject: Re: perfomance comparison
>

---

From: Joseph S D Yao <[email-masked]>
Date: Fri, 2 Mar 2001 13:57:23 -0500

>     Could you give me some hints ?

TIS was absorbed by NAI, and is no more.  Therefore its performance is
similarly non-existant.

The FWTK is probably what you're talking about.  And, particularly, the
http-gw.  It picks up every outgoing query and incoming piece of HTML,
examines them for correctness and any attacks, and passes them on to
the other side.  There is NO WAY to get it to be as fast as a copper
wire; but it provides a heck of a lot more protection!

Having said that, there may be ways to improve its performance.  Why
don't you instrument it and see where it spends its time?

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.