Subject: Re: On the performance of ipfilter
To: David Howland <metalliqaz@fastmail.fm>
From: Johnny C. Lam <jlam@buildlink.org>
List: tech-pkg
Date: 04/06/2005 13:04:12
David Howland wrote:
> I performed a simple experiment to find the problem:
> 
> The PC has two NICs, "outside" and "inside", it acts as a gateway 
> between the outside world and our house, with NAT.  From one of the 
> client PCs (192.168.0.2) I ping three locations.  The "inside" adapter 
> (192.168.0.1), the "outside" adapter (65.x.x.x), and the cable modem 
> (hardwired to 192.168.100.1).  All three pings go at the same time.  I 
> set them to ping forever until I stop it.  In windows, the ping tool 
> actually shows a "request timed out" message when a ping doesn't come 
> back, so I can just sit back and watch the three windows for these 
> timeouts.  There is no other traffic, except perhaps the occasional 
> keep-alive packets from instant messenger.
> 
> The pings to the "inside" and "outside" adapter never show anything but 
> <1ms ping time and never drop packets.  The cable modem ping is less 
> than desirable.  Whats worse is that I can cause packet loss to occur. I 
> have a cron script run every 5 minutes for MRTG.  When this happens, it 
> _always_ drops some packets (even when nice'd).  This is not the only 
> time when packets are dropped, and I have a hunch that other times are 
> due to other processes going on processor.

Can you check what happens when you login to the NAT box and ping the 
cable modem, both with and without IPFilter enabled?  You could also try 
this experiment after opening up the box and swapping the two NICs. 
This would test if the problem is due to that particular "outside" 3Com NIC.

	Cheers,

	-- Johnny Lam <jlam@buildlink.org>