dummynet dropping too many packets

[rihad]

Oleg Bulyzhin wrote:
> On Wed, Oct 07, 2009 at 03:52:56PM +0500, rihad wrote:
> 
>> You probably have some special sources of documentation ;-) According to 
>> man ipfw, both "netgraph/ngtee" and "pipe" decide the fate of the packet 
>> unless one_pass=0. Or do you mean sprinkling smart skiptos here and 
>> there? ;-)
> 
> you can
> 1) use ng_ether & ng_netflow. (so no need in 'ngtee' rule).
> 2) use 'tee' rule with ng_ksocket & ng_netflow
> 
>>> Could you show your 'ipfw show' output? (hide ip addresses if you wish but
>>> keep counters please).
>>>
> 
>> Here it is, in its whole glory:
>>
>> 00100   10434423   1484891105 allow ip from any to any via lo0
>> 00200          2           14 deny ip from any to 127.0.0.0/8
>> 00300          1            4 deny ip from 127.0.0.0/8 to any
>> 01000 3300039938 327603104711 allow ip from any to any in
>> 01010   26214900    421138433 allow ip from me to any out
>> 01020    5453857     46806278 allow icmp from any to any out
>> 01030 3268289053 327224694165 ngtee 1 ip from any to any out
>> 01040   18681181   1089636054 skipto 1100 ip from table(127) to any out 
>> recv bce0 xmit bce1
>> 01060  777488848  76743392754 pipe tablearg ip from any to table(0) out 
>> recv bce0 xmit bce1
>> 01070  776831109  76682499457 allow ip from any to table(0) out recv 
>> bce0 xmit bce1
>> 01100   13102697    808411842 pipe tablearg ip from any to table(2) out
>> 65535  662648946  66711487830 allow ip from any to any
> 
> I guess this one would be better(faster):
> 
> 00050 allow ip from any to any in
> 00100 allow ip from any to any via lo0
> 01010 allow ip from me to any
> 01020 allow icmp from any to any
> 01030 ngtee 1 ip from any to any
> 01035 skipto 1040 ip from any to any recv bce0 xmit bce1
> 01036 allow ip from any to any
> 01040 skipto 1100 ip from table(127) to any
> 01060 pipe tablearg ip from any to table(0)
> 01070 allow ip from any to any
> 01100 pipe tablearg ip from any to table(2)
> 65535 allow ip from any to any
> 
Tried it just now - no visible effect.
400-700 packet drops per second which is around 5-7 mbps dropped on 
output. So I don't think getting rid of one_pass=0 would help at all.