Re: why does netfilter make upload very slow? (was: Re: e1000 -> 82540EM on linux 2.6.0-test[45] very slow in one direction)

On Wed, Oct 08, 2003 at 03:13:20PM +0200, ookhoi@humilis.net wrote:

# > I have netfilter enabled, and will try another -test6 kernel with
# > netfilter not compiled in to see if that indeed makes a difference.
# 
# I can confirm now that disabling netfilter in 2.6.0-test6 makes the nic
# perform oke wrt upload.
# I (just like Florian) had no iptables rules active in the former
# 2.6.0-test6 kernel, but netfilter was compiled in.

Would somebody like to explain why netfilter (in kernel, but not in use)
makes upload go very slow? I am by no means a network guru, but eager to
learn :-)

let's get this straight.  There are five possible cases

a) CONFIG_NETFILTER disabled.  you won't even have the netfilter hooks
   in the network stack (so certainly no netfilter-using modules loaded)
b) CONFIG_NETFILTER enabled, but _no_ modules (iptable_filter,
   ip_conntrack, ...) attached to the netfilter hook
c) CONFIG_NETFILTER enabled and iptable_filter.o (which pulls ip_tables.o)
   loaded, NO RULES in the table
d) CONFIG_NETFILTER enabled and iptable_filter.o (which pulls ip_tables.o)
   loaded, RULES in the table
e) CONFIG_NETFILTER enabled and ip_conntrack.o loaded, iptable_filter
   loaded or not, rules or not

So if you want to give us an idea about where the bottleneck might be,
please clearly indicate between which of the two cases you see this
performance penalty. 

This way we can isolate the culprit.

-- 
- Harald Welte [off-list ref]             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie