5 ms·

In the days when even cheap consumer hardware ships with 2.5G ports, this number seems weirdly low. Does this mean that basically nobody is currently using Open

In the days when even cheap consumer hardware ships with 2.5G ports, this number seems weirdly low. Does this mean that basically nobody is currently using OpenBSD in the datacentre or anywhere that might be expecting to handle 10G or higher per port, or is it just filtering that's an issue? I'm not surprised that the issue exists as even 10 years ago these speeds were uncommon outside of the datacentre, I'm just surprised that nobody has felt a pressing enough need to fix this earlier in the previous few years.

citrin_ru 7mo ago
AFAIK performance is not a priority for OpenBSD project - security is (and other related qualities like code which is easy to understand and maintain). FreeBSD (at least when I followed it several years ago) had better performance both for ipfw and its own PF fork (not fully compatible with OpenBSD one).
- traceroute66 7mo ago
  > AFAIK performance is not a priority for OpenBSD project - security is TBF that was the case historically, but they have absolutely been putting in an effort into performance in their more recent releases. Lots of stuff that used to be simply horrific on OpenBSD, such as multi-peer BGP full-table refreshes is SIGNIFICANTLY better in the last couple of years. Clearly still not as good as FreeBSD, but compared to what it was...
- TuxPowered 7mo ago
  > not fully compatible with OpenBSD one The OpenBSD NAT and scrub syntax, and af-to are available in FreeBSD 15.
toast0 7mo ago
> Does this mean that basically nobody is currently using OpenBSD in the datacentre or anywhere that might be expecting to handle 10G or higher per port, or is it just filtering that's an issue? This looks like it only affects bandwidth limiting. I suspect it's pretty niche to use OpenBSD as a traffic shaper at 10G+, and if you did, I'd imagine most of the queue limits would tend toward significantly less than 4G.
IcePic 7mo ago
One thing could also be that by the time you have 10GE uplinks, shaping is not as important. When we had 512kbit links, prioritizing VOIP would be a thing, and for asymmetric links like 128/512kbit it was prudent to prioritize small packets (ssh) and tcp ACKs on the outgoing link or the downloads would suffer, but when you have 5-10-25GE, not being able to stick an ACK packet in the queue is perhaps not the main issue.
- hrmtst93837 7mo ago
  [flagged]
  - Melatonic 7mo ago
    At this level wouldnt a proper implementation be segregating the link into multiple VMs (or jails?) ? Or is that the same thing on BSD?
    - lazide 7mo ago
      And how would you propose doing that? Note: what do you think the feature essentially does?
traceroute66 7mo ago
> Does this mean that basically nobody is currently using OpenBSD in the datacentre or anywhere Half the problem is lack of proper drivers. I love OpenBSD but all the fibre stuff is just a bit half-baked. For a long time OpenBSD didn't even have DOM (light-level monitoring etc.) exposed in its 1g fibre drivers. Stuff like that automatically kills off OpenBSD as a choice for datacentres where DOM stats are a non-negotiable hard requirement as they are so critical to troubleshooting. OpenBSD finally introduced DOM stats for SFP somewhere around 2020–2021, but it doesn't always work, it depends if you have the right magic combination of SFP and card manufacturer. Whilst on FreeBSD it Just Works (TM). And then overall, for higher speed optics, FreeBSD simply remains lightyears ahead (forgive the pun !). For example, Decisio make nice little router boxes with 10g SFP+ on them, FreeBSD has the drivers out-of-the-box, OpenBSD doesn't. And that's only an SFP+ example, its basically rolling-tumbleweed in a desert territory if you start venturing up to QSFP etc. ...
- CursedSilicon 7mo ago
  How much work is it to port drivers between Free and Open BSD?
  - traceroute66 7mo ago
    > How much work is it to port drivers between Free and Open BSD? IIRC there are two problems at play: First, I'm not a C coder so this is a bit above my pay-grade, but from what little I do remember about the subject, the problem relates to the OpenBSD requirement to adopt their security mechanisms such as pledge, unveil and strlcpy. IIRC the OpenBSD compiler is also (unsurprisingly !) more anal about stack protector W^X etc. So the porting process is perhaps more time-consuming and low-level than it might otherwise be on other porting projects. Second, the licensing thing might come into it. OpenBSD has a high preference to most-permissive, and so things like GPL-licensed origins might not be acceptable. IIRC FreeBSD is a little more relaxed within reason ? And when you're working with network cards I would think that is perhaps hard to avoid to some extent if you're relying on certain bits being ultimately derived from Intel chipsets or whatever. I'm open to correction by those more knowledgable than me on porting intricacies. ;)
Someone 7mo ago
The article is about allowing bandwidth restrictions in bytes/second that are larger than 2³²-1, not about how fast pf can filter packets. I guess few people with faster ports felt the need to limit bandwidth for a service to something that’s that large. FTA: “OpenBSD's PF packet filter has long supported HFSC traffic shaping with the queue rules in pf.conf(5). However, an internal 32-bit limitation in the HFSC service curve structure (struct hfsc_sc) meant that bandwidth values were silently capped at approximately 4.29 Gbps, ” the maximum value of a u_int ". With 10G, 25G, and 100G network interfaces now commonplace, OpenBSD devs making huge progress unlocking the kernel for SMP, and adding drivers for cards supporting some of these speeds, this limitation started to get in the way. Configuring bandwidth 10G on a queue would silently wrap around, producing incorrect and unpredictable scheduling behaviour. A new patch widens the bandwidth fields in the kernel's HFSC scheduler from 32-bit to 64-bit integers, removing this bottleneck entirely.”
- nine_k 7mo ago
  > silently wrap around, producing incorrect and unpredictable Now I'm more scared to use OpenBSD than I was a minute before. I strongly prefer software that fails loudly and explicitly.
  - kaashif 7mo ago
    Yeah, that's pretty appalling. Regardless of how good the philosophy of something is, if it's as niche and manpower constrained as OpenBSD is then it's going to accumulate problems like this.
    - muvlon 7mo ago
      I actually think this isn't even surprising from OpenBSD philosophically. They still subscribe to the Unix philosophy of old, moreso than FreeBSD and much much more than Linux. That is, "worse is better" and it's okay to accept a somewhat leaky abstraction or less helpful diagnostics if it simplifies the implementation. This is why `ed` doesn't bother to say anything but "?" to erroneous commands. If the user messes up, why should it be the job of the OS to handhold them? Garbage in, garbage out. That attitude may seem out of place today but consider that it came from a time when a program might have one author and 1-20 users, so their time was valued almost equally.
ffk 7mo ago
A lot of the time once you get into multi-gig+ territory the answer isn't "make the kernel faster," it's "stop doing it in the kernel." You end up pushing the hot path out to userland where you can actually scale across cores (DPDK/netmap/XDP style approaches), batch packets, and then DMA straight to and from the NIC. The kernel becomes more of a control plane than the data plane. PF/ALTQ is very much in the traditional in-kernel, per-packet model, so it hits those limits sooner.
- cperciva 7mo ago
  pushing the hot path out to userland where you can actually scale across cores What sort of kernel do you have which can't scale across cores?
- toast0 7mo ago
  The big things to avoid are crossing the user/kernel divide and communication across cores. Staying in the kernel is approximately the same as bypassing the kernel (caveats apply); for a packet filtering / smoothing use case, I don't think kernel bypass is needed. You probably want to tune NIC hashing so that inbound traffic for a given shaping queue arrives in the same NIC rx queue; but you probably want that in a kernel bypass case as well. Userspace is certainly nicer during development, as it's easier to push changes, but in 2026, it feels like traffic shaping has pretty static requirements and letting the kernel do all the work feels reasonable to me. Otoh, OpenBSD is pretty far behind the curve on SMP and all that (I think their PF now has support for SMP, but maybe it's still in development?; I'd bet there's lots of room to reduce cross core communication as well, but I haven't examined it). You can't pin userspace cores to cpus, I doubt their kernel datastructures are built to reduce communications, etc. Kernel bypass won't help as much as you would hope, if it's available, which it might not be, because you can't control the userspace to limit cross core communications.
  - rpcope1 7mo ago
    Just a single data point, but the BSDs in general, as much as people like to jerk them off, having tested both recent FreeBSD (which should be much faster than OpenBSD) and Debian on I guess the now kind of elderly APU2s I have, netfilter is noticably faster (and I find nftables to be frankly less challenging than pf) and gets those devices right at gigabit line speed even with complex firewall rules, where as pf leaves performance on the table. It probably has to do with the fact it's an older 4 core design that wasn't super high power to begin with (does still does its job extremely well), but still.
Melatonic 7mo ago
Isnt OpenBSD mainly used for security testing or do I have it wrong? Would be surprised if it was used in production datacenter networking hardware at all. Seems like most people would use one of the proprietary implementations (which likely would include specific written drivers for that hardware) or something like FreeBSD
- SoftTalker 7mo ago
  It's widely used as a router, that's one of its primary uses. But not sure to what scale, likely at small orgs not at major ISPs. But, OpenBSD is a project by and for its developers. They use it and develop it to do what they want; they don't really care what anyone else does or doesn't do with it.
  - Melatonic 7mo ago
    Do people actually use OpenBSD over FreeBSD for use as a router ?
    - zie 7mo ago
      Yes, lots of large providers really want defense in depth at the router/firewall/important services level. They want separate OS's in case a giant CVE or bug comes out for platform X but isn't on platform Y. So multi-platform core services is a key component of systems that need to stay up and alive long-term. Things like Routers, Firewalls, DNS, BGP, etc. Use different software and hardware stacks. We use FreeBSD and Debian @ work, though we are playing around with Nix and Guix now to maybe replace the Debian someday.
- lstodd 7mo ago
  You don't need 4gbps pf queues or even fiber on every single machine in a datacenter. So be surprised, it is used widely for its simplicity and reliability not to mention security compared to those proprietary implementations you speak of, may they rot in hell.
atmosx 7mo ago
PF itself is not tailored towards ISPs and/or big orgs. IPFW (FreeBSD) is more powerful and flexible. OpenBSD shines as a secure all-in-one router SOHO solution. And it’s great because you get all the software you need in the base system. PF is intuitive and easy to work with, even for non network gurus.
asmnzxklopqw 7mo ago
OpenBSD was a great OS back in the late 90s and even early 2000s. In some cases it was competing neck to neck with Linux. Since then, well, Linux grew a lot and OpenBSD not so much. There are multiple causes for this, I will go only through a few: Linux has more support from the big companies; the huge difference in userbase numbers; Linux is more welcoming to new users. And the difference is only growing.
- dim13 7mo ago
  "OpenBSD does not want to attract GNU newbies." misc@ And that's IMHO is a good thing.
- zie 7mo ago
  > Linux is more welcoming to new users. And the difference is only growing. Unless you want documentation. :) Linux documentation is ALL over the place, and it's hard to know if X docs apply to your particular mess. On OpenBSD it's `man <thing>` and you get your docs. Yes man exists on Linux, but lots of tools, especially "new" stuff or linux specific stuff doesn't come with man pages and those that do have man pages, can be missing lots of stuff. Systemd docs tend to be somewhat useless, missing all sorts of stuff. Troubleshooting systemd by reading the docs is usually a waste of time. Reading the source code or getting lucky with a web search is usually your only hope. On FreeBSD you get `man <thing>` AND you get the FreeBSD handbook: https://docs.freebsd.org/en/books/handbook/ https://docs.freebsd.org/en/books/handbook/
daneel_w 7mo ago
Not every in-and-out must pass through a queue in PF. The limitation specifically affected throughput of queues.
PunchyHamster 7mo ago
There is no reason to use OpenBSD (aside "we have OpenBSD nerds in staff" or I guess "we don't want to GPL our changes"), we had it ages ago (for the first of mentioned reasons) but even they dumped it once new server hardware wasn't supported.

citrin_ru 7mo ago

AFAIK performance is not a priority for OpenBSD project - security is (and other related qualities like code which is easy to understand and maintain). FreeBSD (at least when I followed it several years ago) had better performance both for ipfw and its own PF fork (not fully compatible with OpenBSD one).

traceroute66 7mo ago
> AFAIK performance is not a priority for OpenBSD project - security is TBF that was the case historically, but they have absolutely been putting in an effort into performance in their more recent releases. Lots of stuff that used to be simply horrific on OpenBSD, such as multi-peer BGP full-table refreshes is SIGNIFICANTLY better in the last couple of years. Clearly still not as good as FreeBSD, but compared to what it was...
TuxPowered 7mo ago
> not fully compatible with OpenBSD one The OpenBSD NAT and scrub syntax, and af-to are available in FreeBSD 15.

toast0 7mo ago

> Does this mean that basically nobody is currently using OpenBSD in the datacentre or anywhere that might be expecting to handle 10G or higher per port, or is it just filtering that's an issue? This looks like it only affects bandwidth limiting. I suspect it's pretty niche to use OpenBSD as a traffic shaper at 10G+, and if you did, I'd imagine most of the queue limits would tend toward significantly less than 4G.

IcePic 7mo ago

One thing could also be that by the time you have 10GE uplinks, shaping is not as important. When we had 512kbit links, prioritizing VOIP would be a thing, and for asymmetric links like 128/512kbit it was prudent to prioritize small packets (ssh) and tcp ACKs on the outgoing link or the downloads would suffer, but when you have 5-10-25GE, not being able to stick an ACK packet in the queue is perhaps not the main issue.

hrmtst93837 7mo ago
[flagged]
- Melatonic 7mo ago
  At this level wouldnt a proper implementation be segregating the link into multiple VMs (or jails?) ? Or is that the same thing on BSD?
  - lazide 7mo ago
    And how would you propose doing that? Note: what do you think the feature essentially does?

traceroute66 7mo ago

> Does this mean that basically nobody is currently using OpenBSD in the datacentre or anywhere Half the problem is lack of proper drivers. I love OpenBSD but all the fibre stuff is just a bit half-baked. For a long time OpenBSD didn't even have DOM (light-level monitoring etc.) exposed in its 1g fibre drivers. Stuff like that automatically kills off OpenBSD as a choice for datacentres where DOM stats are a non-negotiable hard requirement as they are so critical to troubleshooting. OpenBSD finally introduced DOM stats for SFP somewhere around 2020–2021, but it doesn't always work, it depends if you have the right magic combination of SFP and card manufacturer. Whilst on FreeBSD it Just Works (TM). And then overall, for higher speed optics, FreeBSD simply remains lightyears ahead (forgive the pun !). For example, Decisio make nice little router boxes with 10g SFP+ on them, FreeBSD has the drivers out-of-the-box, OpenBSD doesn't. And that's only an SFP+ example, its basically rolling-tumbleweed in a desert territory if you start venturing up to QSFP etc. ...

CursedSilicon 7mo ago
How much work is it to port drivers between Free and Open BSD?
- traceroute66 7mo ago
  > How much work is it to port drivers between Free and Open BSD? IIRC there are two problems at play: First, I'm not a C coder so this is a bit above my pay-grade, but from what little I do remember about the subject, the problem relates to the OpenBSD requirement to adopt their security mechanisms such as pledge, unveil and strlcpy. IIRC the OpenBSD compiler is also (unsurprisingly !) more anal about stack protector W^X etc. So the porting process is perhaps more time-consuming and low-level than it might otherwise be on other porting projects. Second, the licensing thing might come into it. OpenBSD has a high preference to most-permissive, and so things like GPL-licensed origins might not be acceptable. IIRC FreeBSD is a little more relaxed within reason ? And when you're working with network cards I would think that is perhaps hard to avoid to some extent if you're relying on certain bits being ultimately derived from Intel chipsets or whatever. I'm open to correction by those more knowledgable than me on porting intricacies. ;)

Someone 7mo ago

The article is about allowing bandwidth restrictions in bytes/second that are larger than 2³²-1, not about how fast pf can filter packets. I guess few people with faster ports felt the need to limit bandwidth for a service to something that’s that large. FTA: “OpenBSD's PF packet filter has long supported HFSC traffic shaping with the queue rules in pf.conf(5). However, an internal 32-bit limitation in the HFSC service curve structure (struct hfsc_sc) meant that bandwidth values were silently capped at approximately 4.29 Gbps, ” the maximum value of a u_int ". With 10G, 25G, and 100G network interfaces now commonplace, OpenBSD devs making huge progress unlocking the kernel for SMP, and adding drivers for cards supporting some of these speeds, this limitation started to get in the way. Configuring bandwidth 10G on a queue would silently wrap around, producing incorrect and unpredictable scheduling behaviour. A new patch widens the bandwidth fields in the kernel's HFSC scheduler from 32-bit to 64-bit integers, removing this bottleneck entirely.”

nine_k 7mo ago
> silently wrap around, producing incorrect and unpredictable Now I'm more scared to use OpenBSD than I was a minute before. I strongly prefer software that fails loudly and explicitly.
- kaashif 7mo ago
  Yeah, that's pretty appalling. Regardless of how good the philosophy of something is, if it's as niche and manpower constrained as OpenBSD is then it's going to accumulate problems like this.
  - muvlon 7mo ago
    I actually think this isn't even surprising from OpenBSD philosophically. They still subscribe to the Unix philosophy of old, moreso than FreeBSD and much much more than Linux. That is, "worse is better" and it's okay to accept a somewhat leaky abstraction or less helpful diagnostics if it simplifies the implementation. This is why `ed` doesn't bother to say anything but "?" to erroneous commands. If the user messes up, why should it be the job of the OS to handhold them? Garbage in, garbage out. That attitude may seem out of place today but consider that it came from a time when a program might have one author and 1-20 users, so their time was valued almost equally.

ffk 7mo ago

A lot of the time once you get into multi-gig+ territory the answer isn't "make the kernel faster," it's "stop doing it in the kernel." You end up pushing the hot path out to userland where you can actually scale across cores (DPDK/netmap/XDP style approaches), batch packets, and then DMA straight to and from the NIC. The kernel becomes more of a control plane than the data plane. PF/ALTQ is very much in the traditional in-kernel, per-packet model, so it hits those limits sooner.

cperciva 7mo ago
pushing the hot path out to userland where you can actually scale across cores What sort of kernel do you have which can't scale across cores?
toast0 7mo ago
The big things to avoid are crossing the user/kernel divide and communication across cores. Staying in the kernel is approximately the same as bypassing the kernel (caveats apply); for a packet filtering / smoothing use case, I don't think kernel bypass is needed. You probably want to tune NIC hashing so that inbound traffic for a given shaping queue arrives in the same NIC rx queue; but you probably want that in a kernel bypass case as well. Userspace is certainly nicer during development, as it's easier to push changes, but in 2026, it feels like traffic shaping has pretty static requirements and letting the kernel do all the work feels reasonable to me. Otoh, OpenBSD is pretty far behind the curve on SMP and all that (I think their PF now has support for SMP, but maybe it's still in development?; I'd bet there's lots of room to reduce cross core communication as well, but I haven't examined it). You can't pin userspace cores to cpus, I doubt their kernel datastructures are built to reduce communications, etc. Kernel bypass won't help as much as you would hope, if it's available, which it might not be, because you can't control the userspace to limit cross core communications.
- rpcope1 7mo ago
  Just a single data point, but the BSDs in general, as much as people like to jerk them off, having tested both recent FreeBSD (which should be much faster than OpenBSD) and Debian on I guess the now kind of elderly APU2s I have, netfilter is noticably faster (and I find nftables to be frankly less challenging than pf) and gets those devices right at gigabit line speed even with complex firewall rules, where as pf leaves performance on the table. It probably has to do with the fact it's an older 4 core design that wasn't super high power to begin with (does still does its job extremely well), but still.

Melatonic 7mo ago

Isnt OpenBSD mainly used for security testing or do I have it wrong? Would be surprised if it was used in production datacenter networking hardware at all. Seems like most people would use one of the proprietary implementations (which likely would include specific written drivers for that hardware) or something like FreeBSD

SoftTalker 7mo ago
It's widely used as a router, that's one of its primary uses. But not sure to what scale, likely at small orgs not at major ISPs. But, OpenBSD is a project by and for its developers. They use it and develop it to do what they want; they don't really care what anyone else does or doesn't do with it.
- Melatonic 7mo ago
  Do people actually use OpenBSD over FreeBSD for use as a router ?
  - zie 7mo ago
    Yes, lots of large providers really want defense in depth at the router/firewall/important services level. They want separate OS's in case a giant CVE or bug comes out for platform X but isn't on platform Y. So multi-platform core services is a key component of systems that need to stay up and alive long-term. Things like Routers, Firewalls, DNS, BGP, etc. Use different software and hardware stacks. We use FreeBSD and Debian @ work, though we are playing around with Nix and Guix now to maybe replace the Debian someday.
lstodd 7mo ago
You don't need 4gbps pf queues or even fiber on every single machine in a datacenter. So be surprised, it is used widely for its simplicity and reliability not to mention security compared to those proprietary implementations you speak of, may they rot in hell.

atmosx 7mo ago

PF itself is not tailored towards ISPs and/or big orgs. IPFW (FreeBSD) is more powerful and flexible. OpenBSD shines as a secure all-in-one router SOHO solution. And it’s great because you get all the software you need in the base system. PF is intuitive and easy to work with, even for non network gurus.

asmnzxklopqw 7mo ago

OpenBSD was a great OS back in the late 90s and even early 2000s. In some cases it was competing neck to neck with Linux. Since then, well, Linux grew a lot and OpenBSD not so much. There are multiple causes for this, I will go only through a few: Linux has more support from the big companies; the huge difference in userbase numbers; Linux is more welcoming to new users. And the difference is only growing.

dim13 7mo ago
"OpenBSD does not want to attract GNU newbies." misc@ And that's IMHO is a good thing.
zie 7mo ago
> Linux is more welcoming to new users. And the difference is only growing. Unless you want documentation. :) Linux documentation is ALL over the place, and it's hard to know if X docs apply to your particular mess. On OpenBSD it's `man <thing>` and you get your docs. Yes man exists on Linux, but lots of tools, especially "new" stuff or linux specific stuff doesn't come with man pages and those that do have man pages, can be missing lots of stuff. Systemd docs tend to be somewhat useless, missing all sorts of stuff. Troubleshooting systemd by reading the docs is usually a waste of time. Reading the source code or getting lucky with a web search is usually your only hope. On FreeBSD you get `man <thing>` AND you get the FreeBSD handbook: https://docs.freebsd.org/en/books/handbook/ https://docs.freebsd.org/en/books/handbook/

daneel_w 7mo ago

Not every in-and-out must pass through a queue in PF. The limitation specifically affected throughput of queues.

PunchyHamster 7mo ago

There is no reason to use OpenBSD (aside "we have OpenBSD nerds in staff" or I guess "we don't want to GPL our changes"), we had it ages ago (for the first of mentioned reasons) but even they dumped it once new server hardware wasn't supported.