Evgeniy Sudyr <eject.in...@gmail.com> wrote: > I need to figure if I can improve isakmpd / ipsec performance in my setup > on openbsd -current > > I have two boxes connected to each other via 1Gbit link and I'm using iperf > to test performance with default ipsec.conf between these two servers: > > # cat ipsec.conf: > ike esp from aaa.aaa.aaa.118 to aaa.aaa.aaa.98
Since both your machines have AES-NI, I'd use AES-GCM there ("quick enc aes-128-gcm"). > BOX1 dmesg: > BOX2 dmesg: Those are ncpu=16 and ncpu=8 machines... > During iperf tests I see that both servers CPU usage is low and iperf is > only CPU consumer: That's the CPU usage summed over all cores. But the OpenBSD kernel isn't multithreaded, so it only can make use of a fraction of the total CPU power. -- Christian "naddy" Weisgerber na...@mips.inka.de