Re: LAN vs VLAN interface performance

2014-07-02 Thread Job Snijders
Hi all, I am replying to this thread as I see some resemblance between issue I experience and the quickly rising netlivelocks value. On 24/06/14 3:08 PM, Chris Cappuccio wrote: Kapetanakis Giannis [bil...@edu.physics.uoc.gr] wrote: On 23/06/14 21:33, Henning Brauer wrote: * Chris Cappuccio

Re: LAN vs VLAN interface performance

2014-06-24 Thread Kapetanakis Giannis
On 23/06/14 21:33, Henning Brauer wrote: * Chris Cappuccio ch...@nmedia.net [2014-06-23 20:24]: I have a sandy bridge Xeon box with PF NAT that handles a daily 200 to 700Mbps. It has a single myx interface using OpenBSD 5.5 (not current). It does nothing but PF NAT and related routing. No

Re: LAN vs VLAN interface performance

2014-06-24 Thread Chris Cappuccio
Kapetanakis Giannis [bil...@edu.physics.uoc.gr] wrote: On 23/06/14 21:33, Henning Brauer wrote: * Chris Cappuccio ch...@nmedia.net [2014-06-23 20:24]: I have a sandy bridge Xeon box with PF NAT that handles a daily 200 to 700Mbps. It has a single myx interface using OpenBSD 5.5 (not current).

Re: LAN vs VLAN interface performance

2014-06-24 Thread Brad Smith
On 24/06/14 3:08 PM, Chris Cappuccio wrote: Kapetanakis Giannis [bil...@edu.physics.uoc.gr] wrote: On 23/06/14 21:33, Henning Brauer wrote: * Chris Cappuccio ch...@nmedia.net [2014-06-23 20:24]: I have a sandy bridge Xeon box with PF NAT that handles a daily 200 to 700Mbps. It has a single

Re: LAN vs VLAN interface performance

2014-06-23 Thread Henning Brauer
* Adam Thompson athom...@athompso.net [2014-06-23 07:20]: On 14-06-21 01:03 PM, Chris Cappuccio wrote: Adam Thompson [athom...@athompso.net] wrote: Yes, OT... But unless you've chosen to do something silly (like enabling MVRP, or blindly allowing all VLANs to an untrusted host) saying VLANs

Re: LAN vs VLAN interface performance

2014-06-23 Thread Henning Brauer
* Chris Cappuccio ch...@nmedia.net [2014-06-21 20:05]: Right now all routers and firewalls should be on SP kernels or you will actually have worse performance. This is not true any more and hasn't been for some time. It is, however, true that the extra cores buy you little to nothing for the

Re: LAN vs VLAN interface performance

2014-06-23 Thread Chris Cappuccio
Henning Brauer [lists-open...@bsws.de] wrote: * Chris Cappuccio ch...@nmedia.net [2014-06-21 20:05]: Right now all routers and firewalls should be on SP kernels or you will actually have worse performance. This is not true any more and hasn't been for some time. It is, however, true

Re: LAN vs VLAN interface performance

2014-06-23 Thread Henning Brauer
* Chris Cappuccio ch...@nmedia.net [2014-06-23 20:24]: Henning Brauer [lists-open...@bsws.de] wrote: * Chris Cappuccio ch...@nmedia.net [2014-06-21 20:05]: Right now all routers and firewalls should be on SP kernels or you will actually have worse performance. This is not true any

Re: LAN vs VLAN interface performance

2014-06-22 Thread Adam Thompson
On 14-06-21 01:03 PM, Chris Cappuccio wrote: Adam Thompson [athom...@athompso.net] wrote: Yes, OT... But unless you've chosen to do something silly (like enabling MVRP, or blindly allowing all VLANs to an untrusted host) saying VLANs aren't secure is about as useful as ICMP isn't secure.

Re: LAN vs VLAN interface performance

2014-06-21 Thread Chris Cappuccio
Adam Thompson [athom...@athompso.net] wrote: Yes, OT... But unless you've chosen to do something silly (like enabling MVRP, or blindly allowing all VLANs to an untrusted host) saying VLANs aren't secure is about as useful as ICMP isn't secure. Please explain how VLANs are not secure when you

Re: LAN vs VLAN interface performance

2014-06-20 Thread Boris Goldberg
Hello ML, Thursday, June 19, 2014, 2:21:38 AM, you wrote: Mm I have four /24 subnets and currently have one subnet per ethernet Mm interface (1Gbit/s) on my openbsd firewall. Now I was wondering if in Mm terms of performance (especially latency/pps) it is better to have one Mm subnet per

Re: LAN vs VLAN interface performance

2014-06-20 Thread Henning Brauer
* Boris Goldberg bo...@twopoint.com [2014-06-20 15:51]: There is no real security separation between vlans. sigh. stop spreading myths from the last century. Also OT - is OBSD handling 10 gigabit interfaces at full capacity already? yes -- Henning Brauer, h...@bsws.de, henn...@openbsd.org

Re: LAN vs VLAN interface performance

2014-06-20 Thread Adam Thompson
Yes, OT... But unless you've chosen to do something silly (like enabling MVRP, or blindly allowing all VLANs to an untrusted host) saying VLANs aren't secure is about as useful as ICMP isn't secure. Please explain how VLANs are not secure when you have control of the devices on both ends of an

LAN vs VLAN interface performance

2014-06-19 Thread ML mail
Hello, I have four /24 subnets and currently have one subnet per ethernet interface (1Gbit/s) on my openbsd firewall. Now I was wondering if in terms of performance (especially latency/pps) it is better to have one subnet per ethernet interface like I have now or to have the four subnets on

Re: LAN vs VLAN interface performance

2014-06-19 Thread Mike Jackson
Quoting ML mail mlnos...@yahoo.com: I have four /24 subnets and currently have one subnet per ethernet interface (1Gbit/s) on my openbsd firewall. Now I was wondering if in terms of performance (especially latency/pps) it is better to have one subnet per ethernet interface like I have now

Re: LAN vs VLAN interface performance

2014-06-19 Thread Adam Thompson
On 14-06-19 02:43 AM, Mike Jackson wrote: Quoting ML mail mlnos...@yahoo.com: I have four /24 subnets and currently have one subnet per ethernet interface (1Gbit/s) on my openbsd firewall. Now I was wondering if in terms of performance (especially latency/pps) it is better to have one subnet

Re: LAN vs VLAN interface performance

2014-06-19 Thread Henning Brauer
* ML mail mlnos...@yahoo.com [2014-06-19 09:22]: I have four /24 subnets and currently have one subnet per ethernet interface (1Gbit/s) on my openbsd firewall. Now I was wondering if in terms of performance (especially latency/pps) it is better to have one subnet per ethernet interface like I