Re: maximum performance for 100Mbit/s - how to optimize

Den 24. jun 2004, kl. 19:59, skrev James Yonan:

> John Tracke <ad90182001@xxxxxxxxx> said:
>
> > hi,
> >
> > we need to optimize performance of openvpn for gigabit connection. We 
> > have:
> >
> > server1 gigabit copper ethernet ---- > gigabit eth/optical switch 
> > ---->
> gigabit router ----> output from site1 gigabit optical WAN lines ---> 
> input
> site2 gigabit optical router ---> gigabit switch to copper ethernet 
> --->
> server2 gigabit copper ethernet.
> > Complication is that we are connected to server1 by wireless - there 
> > is
> 155MBit/s licensed radio, capable of ca. 100Mbit effectively, so this 
> is the
> maximum we can really expect to have "in-house". We just don't want to 
> be
> limited by performance after this radio link by any means.
> >  Is somebody able to recommend maximum performance settings? We would 
> > like
> to use UDP, because there is no packet loss on this wireless (and of 
> course
> wired, also) connection and we have the feeling that UDP is faster. 
> Server2 is
> p4/2.4GHz, server1 is Athlon xp2200+, both 256MB ram, 40gb IDE hdd, 
> debian,
> intel pro/1000 cards. We need to run whole bunch of applications thru 
> this,
> you name them - web, ftp, netmeeting, computer based video 
> conferencing, data
> connection for fileservers, possibly voip in short future... We would 
> like the
> link to be totally unvisible for every application, ideally there 
> would be no
> need to mess up with MTU, MSS, etc for clients - let those servers do 
> their
> part of the job and that's it. Simply every application must work.
> > My rough question is : how to optimize this? We don't rely on 
> > encryption
> between those servers, the radio ciphers by itself on its 'hardware' 
> layer and
> we don't suspect anyone to sniffer on optical lines. We simply would 
> like to
> transfer maximum rates from one end to the other. Do those servers need
> upgrade? What parameters should be used for this kind of application?
>
> Are you saying that you are using OpenVPN to make cleartext tunnels, 
> without
> any encryption, and you want to know how to optimize this case?

i hope not.

I would suggest getting either a via C3 with padlock support in both 
ends
to do the actual encryption with hardware support. But this limits you 
to AES128 only.
I suppose you can live with that.
Else you need some other kind of hardware crypto support, but you would 
have
to look closer at openssl to get that.
However, any new machine should be able to run this, but probably not 
handle Gbit speed.

I would also suggest using a tun device and udp.



JonB



-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 - 
digital self defense, top technical experts, no vendor pitches, 
unmatched networking opportunities. Visit www.blackhat.com