Subject: [IPsec] CPU usage for IPSec in Linux 2.6.38

From: "Naveen B N (nbn)" <[email-masked]>
Date: Tue, 10 Jan 2012 19:18:01 +0530

Hi All,
I am using linux 2.6.36 kernel and trying to add 6000 Ikev2/ipsec
tunnels 
at 20 Ikev2 messages per second , I am using netlink socket which is set
to 
NON_BLOCKING and i am sending XFRM SPD added for every successful AUTH
message received.

But the problem is after the 4000 tunnels are established, CPU usage
goes 
to > 90%, which will likely cause dropping of few AUTH response from
responder.

NOTE:
But when I disabled adding SPD messaged via netlink sockets using xfrm
messages,
I am able to complete 6000 ikev2 SA negotiation successfully.

So the problem i am seeing is when sending XFRM netlink message > 4000.

Any solutions are or analysis different then the above is appreciated.

Thanks and Regards
Naveen

---

From: <[email-masked]>
Date: Tue, 10 Jan 2012 08:51:36 -0600

This is the IPSec standard mailing list.  You're talking about a question about some specific implementation; you'll have to ask in a different place.

	paul

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Naveen B N (nbn)
Sent: Tuesday, January 10, 2012 8:48 AM
To: [email-masked]
Subject: [IPsec] CPU usage for IPSec in Linux 2.6.38

Hi All,
I am using linux 2.6.36 kernel and trying to add 6000 Ikev2/ipsec tunnels at 20 Ikev2 messages per second , I am using netlink socket which is set to NON_BLOCKING and i am sending XFRM SPD added for every successful AUTH message received.

But the problem is after the 4000 tunnels are established, CPU usage goes to > 90%, which will likely cause dropping of few AUTH response from responder.

NOTE:
But when I disabled adding SPD messaged via netlink sockets using xfrm messages, I am able to complete 6000 ikev2 SA negotiation successfully.

Thanks and Regards
Naveen
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Naveen B N (nbn)" <[email-masked]>
Date: Wed, 11 Jan 2012 06:29:03 +0530

I apologies for posting in the wrong mailing list.

Regards
Naveen 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Tuesday, January 10, 2012 9:28 PM
To: Naveen B N (nbn)
Subject: Re: [IPsec] CPU usage for IPSec in Linux 2.6.38

Naveen, please talk to your line manager about what the purpose of
[email-masked] is.  If they don't know, then try [email-masked].

-- 
]       He who is tired of Weird Al is tired of life!           |
firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net
architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device
driver[
   Kyoto Plus: watch the video
<http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.