Here I found some dude with the same problem:
http://lkml.org/lkml/2010/7/9/340

On Wed, Sep 29, 2010 at 11:45:21PM +0200, Eric Dumazet wrote:

Le mercredi 29 septembre 2010 ?? 23:18 +0400, Alexey Vlasov a ??crit : 

quoted

Hi.

I'm not sure actually that I should write here, may be I should ask in
netfilter maillist, but if is something wrong please correct me.

CC netdev

quoted

I've got rather large linux shared hosting, and on my new servers I
noticed some strange singularity, that this simple rule:

# iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags
FIN,SYN,RST,ACK SYN -j LOG --log-prefix "ipsec:SYN-OUTPUT "
--log-uid

gives essential time delays simply at ping from the adjacent server
on a local area network. I don't know precisely what's wrong whether the
reason is in the bad support by a kernel of new hardware, or it concerns
generally the new kernel, but now it leads to the situation that even at simple
DDOS attacks to client sites, it becomes difficult to make something, and in
general all works only worse.

It seems to me that with the increase of CPU cores' amount, it only becomes
worse and worse, and, obviously, iptables uses resources of only one processor,
which resources to it for any reason doesn't suffice.

Its not true. iptables can run on all cpus in //

quoted

newbox # iptables -F
otherbox # ping -c 100 newbox
...
100 packets transmitted, 100 received, 0% packet loss, time 100044ms
rtt min/avg/max/mdev = 0.133/2.637/17.172/3.736 ms

OK.

newbox # iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN
-j LOG --log-prefix "ipsec:SYN-OUTPUT " --log-uid
otherbox # ping -c 100 newbox
...
64 bytes from (newbox): icmp_seq=3 ttl=64 time=1.58 ms
64 bytes from (newbox): icmp_seq=4 ttl=64 time=98.7 ms
64 bytes from (newbox): icmp_seq=5 ttl=64 time=18.2 ms
64 bytes from (newbox): icmp_seq=6 ttl=64 time=6.13 ms
64 bytes from (newbox): icmp_seq=7 ttl=64 time=108 ms
...
64 bytes from (newbox): icmp_seq=55 ttl=64 time=2.30 ms
64 bytes from (newbox): icmp_seq=56 ttl=64 time=59.9 ms
64 bytes from (newbox): icmp_seq=57 ttl=64 time=0.155 ms
...
64 bytes from (newbox): icmp_seq=61 ttl=64 time=13.4 ms
64 bytes from (newbox): icmp_seq=62 ttl=64 time=55.0 ms
64 bytes from (newbox): icmp_seq=63 ttl=64 time=0.233 ms
...
100 packets transmitted, 100 received, 0% packet loss, time 99957ms
rtt min/avg/max/mdev = 0.111/7.519/108.061/18.478 ms

newbox # iptables -L -v -n
Chain INPUT (policy ACCEPT 346K packets, 213M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 296K packets, 290M bytes)
 pkts bytes target     prot opt in     out     source               destination
  234 14040 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0    
tcp dpt:80 flags:0x17/0x02 LOG flags 8 level 4 prefix `ipsec:SYN-OUTPUT- '

My old server: Intel SR1500, Xeon 5430, kernel 2.6.24 - 2.6.28
Newbox: SR1620UR, 5650, kernel 2.6.32

Thanks in advance.

Seems strange indeed, since the LOG you add should not slowdown icmp
trafic that much.

But if you send SYN packets in the same time, (logged), this might slow
down the reception (and answers) of ICMP frames. LOG target can be quite
expensive... 

Is using other rules gives same problem ?

iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN
iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN
iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN
iptables -A OUTPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN





--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

-- 
BRGDS. Alexey Vlasov.