[j-nsp] traffic drops to 8 Gb/s when a firewall filter is applied

[Matjaž Straus Istenič]

Hi Gabriel and thank you for the reply,

On 9. dec. 2011, at 18:52, Gabriel Blanchard wrote:

> We have simple filters configured on our 10Gbps as well on our DPCs and can definitely push more than 8gbps. Though mostly in one direction. Are you saying it's limited to 8gbps in both directions?
Yes, in both directions. It was just a test traffic. Symmetric, 10 G in, 10 G out:

- filter deactivated
 Input rate     : 9751115112 bps (820248 pps)
 Output rate    : 9806344680 bps (824894 pps)

- output filter activated (input filter has no influence)
 Input rate     : 9751087040 bps (820246 pps)
 Output rate    : 7983243704 bps (671537 pps)
                  ^^^^^^^^^^^^^^
                  drop to 8 Gb/s

- filter configuration:
term test {
   then accept;
}

> 
> I'm curious to know which Junos version you are running.
10.4R4.5

> 
> Gabriel Blanchard
> Director, Information Technology
> TekSavvy Solutions
> 
> On 11-12-09 10:09 AM, Matjaž Straus Istenič wrote:
>> Hi list,
>> 
>> we've tested the throughput of a 10G interface on a DPCE 4x10GE R running in MX960. We've loaded the interface with almost 10 Gb/s of traffic in both directions and it work fine with no loss until an output filter was activated on the interface. Then the traffic dropped to 8 Gb/s flat.
>> A filter that caused that could be as simple as a single accept term. Input filter doesn't have any impact, only output filter does.
>> Only one logical interface was involved in the tests. Traffic flows in and out through the same interface.
>> 
>> We have a JTAC case opened on this (since september 2011). Latest news from them: we tested this on 1 gig interface and it works fine (!?). Nice, it might work on 100 meg also ;-).
>> 
>> Has anybody on the list run into something similar (not talking about the support, but the effect of the outbound firewall filter on a 10 GE interface ;-))?
>> 
>> Kind regards,
>> 	Matjaž

---
Matjaž Straus Istenič, Arnes
http://www.arnes.si

Tel: +386 1 4798-877
Fax: +386 1 4798-878
matjaz.straus at arnes.si
MS6745-RIPE
PGP 490F3B4F 2009-10-21
Fingerprint = 6172 7BF8 B0B7 1F09 47B3  AFA3 0946 1701 490F 3B4F