user389238's questions

I have a website hosted on commercial G-Suite Google Sites where www version of website works properly, however, the non-www version does not work properly:

# wget www.fashioncodebeautysalon.com
--2018-02-22 21:43:15--  http://www.fashioncodebeautysalon.com/
Resolving www.fashioncodebeautysalon.com (www.fashioncodebeautysalon.com)... 172.217.6.51
Connecting to www.fashioncodebeautysalon.com (www.fashioncodebeautysalon.com)|172.217.6.51|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

index.html                                              [ <=>                                                                                                              ]  19.78K  --.-KB/s    in 0.03s   

2018-02-22 21:43:16 (671 KB/s) - ‘index.html’ saved [20257]

# wget fashioncodebeautysalon.com
--2018-02-22 21:43:20--  http://fashioncodebeautysalon.com/
Resolving fashioncodebeautysalon.com (fashioncodebeautysalon.com)... 216.58.195.83
Connecting to fashioncodebeautysalon.com (fashioncodebeautysalon.com)|216.58.195.83|:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2018-02-22 21:43:20 ERROR 404: Not Found.

To get into this state, in the GoDaddy console I simply created DNS A record and copied IP address that I got when accessing www version of website. Is this correct way to create DNS A record, because I don't know if Google guarantees that this particular IP address will remain constant over time? Is there some other specific IP address that I should have put instead?

Since I am getting 404, then I am inclined to think that problem is not with DNS, but rather with Google Sites where their web server expects the "Host:" value in HTTP request header to have the "www" prefix. However, I am unable to add such address mapping in Google Sites console because subdomain field must not be left blank as seen here:

What am I missing here?

I create an OVS bridge with:

# ovs-vsctl add-br br-int

This create a netdevice that I can see in ifconfig. And then I create a NetworkManager connection and bring it up:

# nmcli connection add type generic con-name br-int autoconnect yes ifname br-int ip4 1.1.1.1/24
# nmcli con up br-int ifname br-int

However, each time after I reboot the host (Ubuntu 16.04) the connection has to be manually brought up again. Is there a way to tell NetworkManager to automatically bring up this interface once OVS has created it?

Can anyone recommend a good IPSec software that can use multiple CPU cores to achieve performance ~2Gbps on Linux dual-CPU quad-core E5620 Xeon setup (total 16HT cores)?

I have tried OpenSwan and StrongSwan. The OpenSwan KLIPS stack runs only on a single CPU core. And the KLIPS+OCF crypto offload also seems to be very badly implemented because it is consuming all 16 CPU cores at 70% while delivering only ~600Mbps. And as a side product it is also reordering TCP packets.

So far with OpenVPN which uses different protocol we were able achieve ~2Gbps on the same hardware with load balancing without any problems. Only 4 out of 16 cores were utilized at 100%. Now it is time to do the same thing with Ipsec. Preferably that should be OpenSource IPsec solution.

Update:

My latest findings indicate that IPsec NETKEY stack might be able to handle two gigs of traffic without a problem (but only on Multiqueue NICs). I was not able to verify this for sure, because it seems that NAPI switches NIC drivers to polling mode under high load and at that time all performance drops from 1.7 Gbps to 500 Mbps. Also it seems that ubuntu 10.04 does not do time accounting for some kernel threads and because of that I do not see how workload is distributed accross all CPU cores.

Could anyone please explain how two following technologies are used to mitigate interrupt overhead under high networking load?

1. Adaptive-rx/Adaptive-tx, and
2. NAPI;

I would appreciate an answer that explains the difference closer to linux kernel source level? Also I would like to hear how to force the NIC to polling/interrupt coalescing mode at load which is ~ 400Mbps.

More background:

The problem seems to be that bnx2 and e1000 drivers ignore "ethtool -C adaptive-rx on" command. This is probably because those drivers do not support adaptive interrupts. Albeit the Broadcom Programmer's reference manual says that this feature should be supported by BCM5709 NIC hardware.

So I decided to try NAPI and reduce weight from 64 to 16 in netif_napi_add() function call to force the NIC in polling mode under much lower load, but unfortunately that did not work out. I guess that NAPI does not need any special hardware support in NIC, is that correct?

The hardware I am using is BCM5709 NIC (it uses bnx2 driver). And OS is Ubuntu 10.04. The CPU is XEON 5620.

NetXtreme II BCM5709 Gigabit Ethernet NIC supports MSI feature (Message Signaled Interrupts) and it has 8 queues. Each queue has its own Interrupt handler in /proc/interrupts. What I am trying to accomplish is to tell NIC which packets should go to which queue.

Questions:

1. Is it possible to manually specify which IP packets should go to which queue by encapsulated protocol type (e.g. IPsec packets go in one queue, while TCP packets go in another queue)?
2. If it is possible - how can I do it under Linux?
3. If it is not possible - should I look at MSI-X capable NIC cards to solve this problem?

More details:

We have one Interface that is terminating IPSec and forwarding/terminating TCP connections. The IPSec packet decryption is inlined (this means that decryption is done under the same ksoftirqd/X context). We are trying to find out if we will be able to improve total performance if IPSec packets will be scheduled on another CPU than TCP packets. One more limitation is that IPSec code is not MP-safe, hence I can not run it under more than one ksoftirqd/X. By default it seems that packets are distributed/hashed by source IP over the 8 NIC queues. The bottleneck is IPSec that chokes out TCP traffic while it is decrypting/encrypting IPSec packets at ~100% CPU under ksoftirqd/X context.

OS is Ubuntu 10.10 (2.6.32-27-server) and NIC is Broadcom BCM5709.

I am interested in particular answers:

1. Does the NIC with GRO edits/creates TCP ACK or any other packets (or is this feature transparent to receiver/sender TCP stacks)?
2. There should be a timeout/event when NIC should pass the "glued segments" to the TCP stack? What are they?
3. In packet forwarding setup - does the GRO feature also tries to read receiver ACKs (see below why I am asking this)?
4. Any source that explains GRO and also other NIC offloading features (TSO, LSO ...) better than wikipedia and linux man pages would be really appreciated.

More details:

I am troubleshooting a performance problem with one IPSec implementation. The problem is that available bandwidth is not evenly distributed across all 4 VPN tunnels (distributed approximately as 200MBps/200MBps/1MBps/1MBps; Each VPN tunnel encapsulates single TCP connection). In PCAP once in a while I see that webserver idles for like ~2 seconds (waiting for ACK). Downloading resumes when webserver retransmits unacknowledged segments.

My inner felling from PCAP is that NIC GRO feature glues packets together but sometimes do not pass them to TCP stack in a timely manner and that is causing the problems.

As this VPN server does not have interfaces that terminate TCP connections but rather only forwards packets. Then I tried to disable GRO and after that I observed that traffic was evenly distributed across all tunnels. Also when TCP window scaling is disabled on Webserver, then bandwidth is also even distributed even with GRO enabled (that is why I had question #3).

I am using 2.6.32-27 linux on Ubuntu 10.04 server (64-bit). NIC is Intel 82571EB. All interfaces (HTTP client, VPN client, VPN Server, Webserver) are connected directly in chain with 1Gbit Ethernet cables.