LXC strange upload network speed

[openaspace]

Hello.
I have moved a VPS configuration to LXC with debian and from the 90MB/s of the VPS , now I can reach only 40MB/s with the container.
Also occour that a download start at 40MB/s and go down around 25/30 MB/s.... The available host bandwidth is 1Gbps.

If I start other downloads at the same time, the download bandwidth don't encrease, but remain around 30/MB/s and the speed of each transfer is divided within the 30MB

The lxc ram is free for 70%, the host cpu 50%, host RAM 35% free.
The LXC is behind OPNSENSE firewall... therefore i have tried to give more ram and cpu to the firewall..
but no results...

on the VPS i was using multiqueque to 8, but with LXC there no parameters to set....

What can be the problem...?

Thank you.

 

[wolfgang]

Hi,

I guess you use the wrong type of vnic on the Opensense.
The 30 MB/s sounds like an e1000. Use a virtio for the Opensense and disable the hardware checksum offload.

 

[openaspace]

Hi,

I guess you use the wrong type of vnic on the Opensense.
The 30 MB/s sounds like an e1000. Use a virtio for the Opensense and disable the hardware checksum offload.

Yes, but with Virtio I can reach only 20Mb/s..
I was tried to use e100 for this problem, poor speed with virtio instead of e100..

What can be the problem?
offload etc.. are disabled from months

 

[wolfgang]

What do you use as phy Nic for this vnic?

 

[openaspace]

What do you use as phy Nic for this vnic?

 

[openaspace]

What do you use as phy Nic for this vnic?

I Have found the problem.
is the Intrusion Detection system of opensense.

When I stop it I can reach top speed... how is possible?
When enabled the opnsense cpu is a 30% and a lot of ram free

 

[wolfgang]

I'm not using opensense, but there are two things about performance with IDS.

1.) how many threads do you use? I would look at the processes, and maybe you have only one Suricata process with about 100% utilization.
2.) the latency will increase if you use IDS to reduce the max bandwidth.

If you use IDS, I would consider using for the WAN a passthrough NIC or VF if you nic support this.

 

[openaspace]

I'm not using opensense, but there are two things about performance with IDS.

1.) how many threads do you use? I would look at the processes, and maybe you have only one Suricata process with about 100% utilization.
2.) the latency will increase if you use IDS to reduce the max bandwidth.

If you use IDS, I would consider using for the WAN a passthrough NIC or VF if you nic support this.

Hello, thanks for your support.
I use 8 thread and IPS it's not set to reduce bandwidth.