performance issue within VNET jail

[Michael Grimm]

Kristof Provost <kristof at sigsegv.be> wrote
> On 21 Dec 2017, at 21:50, Michael Grimm wrote:
>> Kristof Provost <kristof at sigsegv.be> wrote:

>>> Can you try turning off TSO? (`ifconfig $ifname -tso`)
>>> 
>>> There have been issues with pf and TSO checksums, which looked a lot like this (i.e. bad TCP performance). Those problems should be fixed, but this is easy to test.

>> I did try it, but without success.

> Hmm. I’ve got no ideas at the moment. I run a very similar setup (although on CURRENT), and see no performance issues from my jails.
> Can you test a performance test without pf? Perhaps from the local LAN for example? That should help narrow it down a bit, at least.

Well I prepared on of my webservers running at hostB/jailX to serve a sample file for local downloading tests:

1) hostA	wget from hostB/jailX sample file: about  30 MB/s
2) hostA/jailY	wget from hostB/jailX sample file: about  30 MB/s
3) hostB	wget from hostB/jailX sample file: about 190 MB/s
4) hostB/jailY	wget from hostB/jailX sample file: about 190 MB/s

Hmm. At least tests 3) and 4) omit the pf firewall. Tests 1) qnd 2) include passing two firewalls, one at each host. BUT: Both hosts are connected via an IPSec tunnel, and that's esp not tcp.

Can anyone draw conclusions from this test? 
I cannot ;-)

Thanks and regards,
Michael