Ravin,
Due to the RX and TX actions that need to be performed on an SA in an ‘atomic’
fashion, each SA is bound to a single worker thread. The trhread chosen is the
one that first sees a packet for that SA. When subsequent packets arrive on a
different thread they need to be transferred to the SA’s bound thread – this
process is called handoff.
The drops you are seeing occur when the input rate on the receive thread
exceeds the tx rate on the SA’s thread. You might look at which threads are
involved and see if the handoff can be avoided or at least reduced. Otherwise
this is an indication that VPP is hitting a processing limit.
/neale
From: <vpp-dev@lists.fd.io> on behalf of "ravinder.ya...@hughes.com"
<ravinder.ya...@hughes.com>
Date: Wednesday 26 February 2020 at 23:59
To: "vpp-dev@lists.fd.io" <vpp-dev@lists.fd.io>
Subject: [vpp-dev] Error: esp4-encrypt-tun-handoff : congestion drop #ipsec
[Edited Message Follows]
Folks,
I am seeing packet congestion drop errors "esp4-encrypt-tun-handoff". What
could be the reason for this and how can i debug this further?
124 ikev2 IKEv2 packets processed
31 ikev2 IKE_SA_INIT retransmit
31 ip4-udp-lookup no error
19061984 esp4-decrypt-tun ESP pkts received
1 esp4-decrypt-tun Integrity check failed
134757254 esp4-encrypt-tun ESP pkts received
19061984 ipsec4-tun-input good packets received
33913 esp4-encrypt-tun-handoff congestion drop
31 ip4-glean ARP requests sent
263 ethernet-input no error
Thank you,
-Ravin
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#15581): https://lists.fd.io/g/vpp-dev/message/15581
Mute This Topic: https://lists.fd.io/mt/71573632/21656
Mute #ipsec: https://lists.fd.io/mk?hashtag=ipsec&subid=1480452
Group Owner: vpp-dev+ow...@lists.fd.io
Unsubscribe: https://lists.fd.io/g/vpp-dev/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
