Dnia wtorek, 22 października 2013 16:16:09 Guus Sliepen pisze: > On Tue, Oct 22, 2013 at 03:38:20PM +0200, Dariusz Bączkowski wrote: > > I use standard tinc settings and tests look like this: > > tinc version 1.0.19 (built Apr 22 2013 21:45:37, protocol 17) > > [ 6] local 10.71.0.15 port 37975 connected with 10.71.0.1 port 5001 > > [ ID] Interval Transfer Bandwidth > > [ 6] 0.0-10.0 sec 268 MBytes 224 Mbits/sec > > [ 5] local 10.71.0.15 port 5001 connected with 10.71.0.1 port 47211 > > [ 5] 0.0-10.0 sec 246 MBytes 206 Mbits/sec > > > > Without tinc: > > [ 6] local 10.81.0.15 port 39846 connected with 10.81.0.1 port 5001 > > [ ID] Interval Transfer Bandwidth > > [ 6] 0.0-10.0 sec 1.10 GBytes 943 Mbits/sec > > [ 5] local 10.81.0.15 port 5001 connected with 10.81.0.1 port 48362 > > [ 5] 0.0-10.0 sec 1.10 GBytes 941 Mbits/sec > > > > This is better then in your case but I also was expecting more. Servers > > are > > connected directly without switch. I suspect that problem is with CPU > > power > > because tincd saturates one core to 100% in such transfers (Intel(R) > > Xeon(R) CPU E5-2620 0 @ 2.00GHz). > > The E5-2620 has AES instructions, you could try setting Cipher = > aes-128-cbc. I don't think you'd get more than 300 Mbit/s though, a big > part of the CPU power is actually spent doing SHA1 HMACs.
We have different CPUs on hosts connected from Internet to this VPN network, not all have hardware AES. I think switching to AES could slow down transfers between some host and we do not want that. We will just make a point to have hardware AES on new hardware we are going to migrate to. Thank you for suggestion. -- Pozdrawiam, Dariusz Bączkowski ESYSCODER Dariusz Bączkowski e-mail: [email protected] tel.: +48 720 820 220 fax: +48 947 166 554 http://esyscoder.pl/ http://system-taxi.pl/
signature.asc
Description: This is a digitally signed message part.
_______________________________________________ tinc mailing list [email protected] http://www.tinc-vpn.org/cgi-bin/mailman/listinfo/tinc
