3 ms·
Good intro. I can relate, I had to debug conntrack dropping packets and performance issues and it's not easy. Cherry on top, there aren't two distributions taki
by user5994461 7y ago
Good intro. I can relate, I had to debug conntrack dropping packets and performance issues and it's not easy. Cherry on top, there aren't two distributions taking the same settings.
Also have a look into the conntrack hashsize. The conntrack connection table is a hashtable and the hashsize is how many buckets it has. This affect collisions, memory consumption and cache hits.
Then conntrack timeouts settings, that decide when connections can be released from the tables. Connections can be hold by default for minutes even after close. The most trivial performance test can cycle a million connections in a minute and put down any system using conntrack.
I wouldn't have guessed that cloudflare relied heavily on conntrack. It's not that scalable or easy to use IMO.
- majke 7y agoConntrack evolved recently and is thought to be fast. Florian Westphal once said that an iptable rule doing -j NOTRACK is slower than hitting conntrack. The rationale is that iptables need to do indirect jumps, which with spetre mitigations means retpoline which means slow. So... conntrack avoids the indirect jumps and is faster than a couple of indirect jumps that would be taken on the iptables exception path. But I haven't done the benchmarks so I didn't want to put that in the post. Anyhow, barring the SYN flood aspect, I think conntrack is fast enough for everybody. The only exceptions might be... dunno... HFT.
- user5994461 7y agoconntrack structures can be multi gigabytes when sized to handle a hundred thousand connections per minute and upward. It can cache miss on connection lookup with each new network packet. What is slower between memory cache miss and indirect jump? I do not know, haven't done a benchmark either.