is polling still a thing?
wishmaster
artemrts at ukr.net
Tue Jan 27 19:23:05 UTC 2015
Have you consider to use netmap-based ipfw instead pf in DDoS mitigation? I think you should. And without any network ''haks'' like polling.
Cheers,
Vitaly
--- Original Message ---
From: "Antoine Beaupré"
Date: 27 January 2015, 19:28:55
> (Please CC, as i am not on the list.)
>
> I was surprised to read this article in the pfSense blog:
>
> https://blog.pfsense.org/?p=115
>
> TLDR: "At this time, polling is not recommended at all."
>
> Is that true? I am trying to tweak a Supermicro machine as a router to
> survive major DDOS attacks on a 1gbps link. So far, I can't get far
> beyond the 100kpps and 50mbps mark.
>
> The hardware is:
>
> * 2xIntel E1G44HTBLK NICs
> * 1xIntel 1220LV2 CPU
>
> More detailed specs here:
>
> https://wiki.koumbit.net/rtr1.koumbit.net
>
> We are using a stateful pf firewall and polling on the network
> interfaces. We got around 100kpps during the DDOS, with 700kpps dropped
> (or at least 700k/s errors) on the NIC. The DDOS was apparently 5.5gbps
> but around 400mbps reached our port from upstream's point of view. The
> kernel interfaces counted around 50mbps:
>
> https://redmine.koumbit.net/attachments/download/7706
> https://redmine.koumbit.net/attachments/download/7707
> https://redmine.koumbit.net/attachments/download/7708
> https://redmine.koumbit.net/attachments/download/7709
>
> The load on the router was fine during the DDOS, but of course packet
> loss was endemic.
>
> At this point, I'm considering the following options:
>
> * switching to an Intel IGB nic
> * enabling fastforwarding
> * tweak the number of IGB queues
>
> Any recommendations would be welcome.
>
> Thanks!
>
> A.
>
> --
> feature, n: a documented bug | bug, n: an undocumented feature
> - Mario S F Ferreira
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>
More information about the freebsd-net
mailing list