Avoiding natd overhead

[Luigi Rizzo]

On Mon, Oct 23, 2006 at 12:50:05PM -0600, Brett Glass wrote:
> At 10:21 PM 10/21/2006, Julian Elischer wrote:
> 
> >OR in 7.0 you can call netgraph directly
> >
> >there is a netgraph keyword in ipfw.
> 
> I just took a look at that. Could work, except that the ng_nat 
> Netgraph node only does very basic NAT. One can't do static NAT, 
> and none of natd's other options are accessible.

there is another part of paolo's work that adds the
'nat' keyword to ipfw. Even if not merged, i think it is
available as a patch, right paolo ?

> Whilst perusing the code, I also noticed that libalias expects all 
> packets to be in a single contiguous buffer. This means that ng_nat 
> doesn't get rid of one of the big inefficiencies involved in the 
> use of natd: the need to make a copy of the mbuf chain containing 

the copy may have been a problem 20 or even 10 years ago.
These days, with huge memory bandwidths and because of the
effect of burst access to memory, i would be surprised if
the memcopy overhead were anything significant.

Yes, you trash the cache a bit, but on the other hand you
bring early in-cache the fields you need to inspect.

The real performance issue with divert is the system call.
Next, I'd also check if there is a scalability issue
related to inefficient data structures.

cheers
luigi

> the packet to ensure contiguity. (This is an issue with anything 
> that uses divert sockets, but it creeps in with ng_nat as well due 
> to the way libalias is coded.) Using a Netgraph node would help 
> with the ring transition, though, so there should be some savings. 
> Has the "netgraph" keyword been MFCed?
> 
> --Brett Glass
> 
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"