IPv6 Connection Tracking Excess CPU usage

I am running Linux 2.6.26 on my board. When I enable IPv6 connection
tracking support, i.e., CONFIG_NF_CONNTRACK_IPV6=y, and send 3
megabits of data to the board with iperf, the CPU usage according to
top for events/0 goes up to 99-100%. Without CONFIG_NF_CONNTRACK_IPV6
enabled, the CPU usage for events/0 is only 17-18%.

Has anyone else seen this issue? Is there a fix?

On 07/29/2011 02:18 AM, Washington Ratso wrote:
> I am running Linux 2.6.26 on my board. When I enable IPv6 connection
> tracking support, i.e., CONFIG_NF_CONNTRACK_IPV6=y, and send 3
> megabits of data to the board with iperf, the CPU usage according to
> top for events/0 goes up to 99-100%. Without CONFIG_NF_CONNTRACK_IPV6
> enabled, the CPU usage for events/0 is only 17-18%.

That fact exhibits the proof that the CONFIG_NF_CONNTRACK_IPV6 kernel
code has low performance. It is not an easy job to write a good code to
perform connection tracking.

> Has anyone else seen this issue? Is there a fix?

Yes, but not with that flag. The fix is to update your kernel to the
last version, and to hope kernel developers wrote a code with a better
performance.

On Sat, 2011-07-30, Stephane Le Men wrote:
> On 07/29/2011 02:18 AM, Washington Ratso wrote:
>> I am running Linux 2.6.26 on my board. When I enable IPv6 connection
>> tracking support, i.e., CONFIG_NF_CONNTRACK_IPV6=y, and send 3
>> megabits of data to the board with iperf, the CPU usage according to
>> top for events/0 goes up to 99-100%. Without CONFIG_NF_CONNTRACK_IPV6
>> enabled, the CPU usage for events/0 is only 17-18%.

Is that by just *including* CONFIG_NF_CONNTRACK_IPV6 in your kernel,
or do you also *enable* it (using iptables, I suppose)?

> That fact exhibits the proof that the CONFIG_NF_CONNTRACK_IPV6 kernel
> code has low performance.

Not *proof*, but an indication. I don't know iperf -- does it do
something abnormal which causes each packet to create a connection?
What are the OP's figures for IPv4?

> It is not an easy job to write a good code to
> perform connection tracking.

No, but one would naively think the algorithm would be the same as for
IPv4.

/Jorgen

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .

Hello,

Jorgen Grahn a écrit :
>> On 07/29/2011 02:18 AM, Washington Ratso wrote:
>>> I am running Linux 2.6.26 on my board. When I enable IPv6 connection
>>> tracking support, i.e., CONFIG_NF_CONNTRACK_IPV6=y, and send 3
>>> megabits of data to the board with iperf, the CPU usage according to
>>> top for events/0 goes up to 99-100%. Without CONFIG_NF_CONNTRACK_IPV6
>>> enabled, the CPU usage for events/0 is only 17-18%.
>
> Is that by just *including* CONFIG_NF_CONNTRACK_IPV6 in your kernel,
> or do you also *enable* it (using iptables, I suppose)?

If CONFIG_NF_CONNTRACK_IPV6=y (built into the kernel, not as a module)
then IPv6 conntrack is enabled. No need to use ip6tables.

Jorgen Grahn <grahn+(E-Mail Removed)> wrote:
> On Sat, 2011-07-30, Stephane Le Men wrote:
> > On 07/29/2011 02:18 AM, Washington Ratso wrote:
> >> I am running Linux 2.6.26 on my board. When I enable IPv6
> >> connection tracking support, i.e., CONFIG_NF_CONNTRACK_IPV6=y,
> >> and send 3 megabits of data to the board with iperf, the CPU
> >> usage according to top for events/0 goes up to 99-100%. Without
> >> CONFIG_NF_CONNTRACK_IPV6 enabled, the CPU usage for events/0 is
> >> only 17-18%.

> Is that by just *including* CONFIG_NF_CONNTRACK_IPV6 in your kernel,
> or do you also *enable* it (using iptables, I suppose)?

> > That fact exhibits the proof that the CONFIG_NF_CONNTRACK_IPV6
> > kernel code has low performance.

> Not *proof*, but an indication. I don't know iperf -- does it do
> something abnormal which causes each packet to create a connection?

I don't track iperf all *that* closely, but suspect that it does not.
Also, I don't think it has anything like the netperf TCP_CRR
(Connect/Request/Response) or TCP_CC (Connect/Close) tests which would
be very connection establishment/tear-down heavy.

rick jones
--
The glass is neither half-empty nor half-full. The glass has a leak.
The real question is "Can it be patched?"
these opinions are mine, all mine; HP might not want them anyway...
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

its so nice to visit here a nice thread. Am so impressed with your such a good hard work, its definitely a good and diferent idea for others, you guys are doing good work good luck, keep it up..