3

I am making a packet filtering program running on Ubuntu 12.04 which uses libipq as the library for copying packets into userspace. The logic of libipq works fine for me, my issue is that I have noticed a significant performance hit from using libipq to not using libipq. If I remove my iptable rules that I added for my program and let the kernel handle the packets, the speed is 50 MB/s. However, when using libipq and having restored my iptables rule, the speed goes down to 1 MB/s (if i'm lucky), it's usually half of that.

I wonder, could something be wrong with my iptable rules? Could there be a more efficient use of rules, or is libipq simply that inefficient (or my code even though I don't do that much)? Here is the script I use to setup my iptable rules:

#!/bin/sh
modprobe iptable_filter
modprobe ip_queue
iptables -A FORWARD -p icmp -j QUEUE
iptables -A FORWARD -p tcp -j QUEUE
iptables -A FORWARD -p udp-j QUEUE
iptables -A INPUT -p icmp -j QUEUE
iptables -A INPUT -p tcp -j QUEUE
iptables -A INPUT -p udp -j QUEUE

Other than that, my iptable rules are the default set that came with Ubuntu.

NOTE: My setup is for a client and server VM on two different subnets and using my Ubuntu VM to bridge both using NAT and ip masquerading.

Olivier Trahan
  • 95
  • 1
  • 1
  • 5
  • I think the speed penalty is caused by userspace processing and delivery from kernel to userspace and vice versa. This should not be particular for libipq – Satish Feb 05 '13 at 21:22
  • Libipq has been deprecated in favour of the newer libnetfilter_queue – Satish Feb 05 '13 at 21:25
  • worth checking http://www.youtube.com/watch?v=rfV8AXc5-zw – Satish Feb 05 '13 at 21:35
  • @Satish: I know that some speed will be lost because of userspace processing and queuing, but I have heard from other libipq users that it is not a problem for them and that they don't experience such a dramatic speed loss. Though I could benefit from using libnetfilter_queue, I would prefer not to have to rewrite the code! – Olivier Trahan Feb 05 '13 at 23:14
  • 1
    I have switched to libnetfilter_queue and have seen considerable improvement :) It's a shame that libipq was the problem... – Olivier Trahan Feb 07 '13 at 18:35

1 Answers1

4

Libipq has been deprecated in favour of the newer libnetfilter_queue

Community
  • 1
  • 1
Satish
  • 16,544
  • 29
  • 93
  • 149