RE: [IPsec] CPU usage for IPSec in Linux 2.6.38

I think the issue is when adding an entry to SPD 
Database which already contains 4000 entries, because 
The entries have to be checked before adding the 
New entry.

Regards
Naveen  

-----Original Message-----
From: John Lowry [mailto:jlowry@bbn.com] 
Sent: Tuesday, January 10, 2012 8:25 PM
To: Naveen B N (nbn)
Subject: Re: [IPsec] CPU usage for IPSec in Linux 2.6.38

The only time we had troubles like this was with
a Dell 1U that had rotten drivers.  Upgrading to
different kernel and updated drivers fixed the problem.


On Jan 10, 2012, at 8:48 AM, Naveen B N (nbn) wrote:

Hi All,
I am using linux 2.6.36 kernel and trying to add 6000 Ikev2/ipsec
tunnels 
at 20 Ikev2 messages per second , I am using netlink socket which is

set

to 
NON_BLOCKING and i am sending XFRM SPD added for every successful AUTH
message received.

But the problem is after the 4000 tunnels are established, CPU usage
goes 
to > 90%, which will likely cause dropping of few AUTH response from
responder.

NOTE:
But when I disabled adding SPD messaged via netlink sockets using xfrm
messages,
I am able to complete 6000 ikev2 SA negotiation successfully.

So the problem i am seeing is when sending XFRM netlink message >

4000.

Any solutions are or analysis different then the above is appreciated.


Thanks and Regards
Naveen 
_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec