3 ms·
It says you get about a Gbit of throughput. That isn't bad but I wonder if that is simply because the processing isn't or can't be efficiently paralleled. You
by edoo 8y ago
It says you get about a Gbit of throughput. That isn't bad but I wonder if that is simply because the processing isn't or can't be efficiently paralleled.
You might be able to make several of these connections between 2 machines and trunk/bond them on each side into a combined interface for even more throughput. 10Gbe and 40Gb fiber cards are getting pretty cheap.
- cyphar 8y ago> It says you get about a Gbit of throughput. That isn't bad but I wonder if that is simply because the processing isn't or can't be efficiently paralleled. The encryption is parallelised, Jason Donenfield talks about how the parallelism is designed in most of his talks about WireGuard. Effectively the problem is that network processing is done using "flows" and generally you want to pin a single flow to a single CPU -- but that would result in bad performance (especially if related packets were encrypted on separate CPUs). So instead, WireGuard pretends to support hardware packet offloading -- so the rest of the net infrastructure figures out what packets are related and gives WireGuard a coalesced packet which can then be split and encrypted in one go.
- edoo 8y agoCool, I just realized they also used a 1GbE card in the perf test so they maxed it out. That would be pretty neat if it scaled right on up.