[Soekris] Screams of frustration were heard...

[Hans-Joerg Hoexer]

Hi,

On Tue, May 06, 2003 at 11:27:49AM -0700, Stephen Milton wrote:
> I have now run my Soekris 4521s through complete speed testing under
> Debian Linux, FreeBSD 4.8, and OpenBSD 3.3.  I have the Hifn VPN
> accelerators in each unit.  However, I am frustrated by the fact that
> I cannot seem to configure more than 3-4Mb/s of IPSEC throughput in
> any combination of OS or patches.

I suppose you were using 3des for encryption.  Try using aes or blowfish, i.e.
the accelerator will _not_ be used.  If you are using FreeS/WAN for Linux, you
need additional patches for aes/blowfish support.  On a soekris regarding
IPsec/VPN-performance aes in software is "faster" than 3des in hardware.

The problem with the soekris boxen and the crypto accelerator seems to be
related to the overhead of using the accelerator: the CPU is too weak and can
not keep the accelerator busy at a sustained rate.

On a normal PC with a soekris accelerator I get about 70Mb/s (encrypting 8192
times 8k blocks of data with 3des, using /dev/crypto on OpenBSD,
sysctl.usercrypto=1).

Cheers,
Hans
-- 
pub  1024D/513AEFD9 1999-12-18 Hans-Joerg Hoexer 
			     <Hans-Joerg.Hoexer at yerbouti.franken.de>
Key fingerprint = 83D2 436A 0D3C 34A9 E0FF  4C33 35F6 617C 513A EFD9