设为首页 收藏本站
查看: 978|回复: 0

[经验分享] xen traffic control problems

[复制链接]

尚未签到

发表于 2015-4-13 11:53:42 | 显示全部楼层 |阅读模式
Problem 1: UDP, VLANs and Lack of Flow Control
Problem
    VLAN devices do not support scatter-gather
    This means the that each skb needs to be linearised and thus cloned if they are trasmitted on a VLAN device
    Cloning results in the original fragments being released
    This breaks Xen's netfront/netback flow-control
Result
    A guess can flood dom0 with packets
    Very effective DoS attack on dom0 and other domUs
Work-Around
    Use the credit scheduler to limit the rate of a domU's virtual interface to something close to the rate of the physical interface:
        vif = [ "mac=00:16:36:6c:81:ae,bridge=eth4.100, script=vif-bridge,rate=950Mb/s" ]
    Still uses quite a lot of dom0 CPU if domU sends a lot of packets
    But the DoS is mitigated
Partial Solution
    scatter-gather enabled VLAN interfaces
    Problem is resolved for VLANS with supported physical devices
    Still a problem for any other device that doesn't support scatter-gather
Patches
    Included in v2.6.26-rc4
        "Propagate selected feature bits to VLAN devices" and;
        "Use bitmask of feature flags instead of seperate feature bit" by Patrick McHardy.
        "igb: allow vlan devices to use TSO and TCP CSUM offload" by Jeff Kirsher
    Patches for other drivers have also been merged
Problem 2: Bonding and Lack of Queues
Problem
    The default queue on bond devices is no queue
        This is because it is a software device, and generally queuing doesn't make sense on software devices
    qdiscs default the queue-length of their device
   
Result
    It was observed that netperf TCP STREAM only achieves 45-50Mbit/s when controlled by a class with a ceiling of 450Mbit/s
    A 10x degredation!
Solution 1a
    Set the queue length of the bonding device before adding qdiscs
    ip link set txqueuelen 1000 dev bond0
   
Solution 1b
    Set the queue length of the qdisc explicitly
    tc qdisc add dev bond0 parent 1:100 handle 1100: pfifo limit 1000
Problem 3: TSO and Lack of Accounting Accuracy
Problem
Problem
    If a packet is significantly larger than the MTU of the class, it is accounted as being approximately the size of the MTU.
    And the giants counter for the class is incremented
    In this case, the default MTU is 2047 bytes
    But TCP Segmentation Offload (TSO) packets can be much larger: 64kbytes
    By default Xen domUs will use TSO
Result
    The result similar to no bandwidth control of TCP
Workaround 1
Disable TSO in the guest, but the guest can re-enable it
    # ethtool -k eth0 | grep "tcp segmentation offload"
    tcp segmentation offload: on
    # ethtool -K eth0 tso off
    # ethtool -k eth0 | grep "tcp segmentation offload"
    tcp segmentation offload: off
Workaround 2
Set the MTU of classes to 40000
Large enough to give sufficient accuracy
Larger values will result in a loss of accuracy when accounting smaller packets
#tc class add dev peth2 parent 1:1 classid 1:101 rate 10Mbit ceil 950Mbit mtu 40000
Solution
    Account for large packets
    Instead of truncating the index, use rtab values multiple times
        rtab[255] * (index >> 8) + rtab[index & 0xFF]
    "Make HTB scheduler work with TSO" by Ranjit Manomohan was included in 2.6.23-rc1

运维网声明 1、欢迎大家加入本站运维交流群:群②:261659950 群⑤:202807635 群⑦870801961 群⑧679858003
2、本站所有主题由该帖子作者发表,该帖子作者与运维网享有帖子相关版权
3、所有作品的著作权均归原作者享有,请您和我们一样尊重他人的著作权等合法权益。如果您对作品感到满意,请购买正版
4、禁止制作、复制、发布和传播具有反动、淫秽、色情、暴力、凶杀等内容的信息,一经发现立即删除。若您因此触犯法律,一切后果自负,我们对此不承担任何责任
5、所有资源均系网友上传或者通过网络收集,我们仅提供一个展示、介绍、观摩学习的平台,我们不对其内容的准确性、可靠性、正当性、安全性、合法性等负责,亦不承担任何法律责任
6、所有作品仅供您个人学习、研究或欣赏,不得用于商业或者其他用途,否则,一切后果均由您自己承担,我们对此不承担任何法律责任
7、如涉及侵犯版权等问题,请您及时通知我们,我们将立即采取措施予以解决
8、联系人Email:admin@iyunv.com 网址:www.yunweiku.com

所有资源均系网友上传或者通过网络收集,我们仅提供一个展示、介绍、观摩学习的平台,我们不对其承担任何法律责任,如涉及侵犯版权等问题,请您及时通知我们,我们将立即处理,联系人Email:kefu@iyunv.com,QQ:1061981298 本贴地址:https://www.yunweiku.com/thread-56638-1-1.html 上篇帖子: Ubuntu 10.04安装Xen 4.0.1添加Xenoprof支持 下篇帖子: Xen server三为xen添加存储及创建虚拟机
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

扫码加入运维网微信交流群X

扫码加入运维网微信交流群

扫描二维码加入运维网微信交流群,最新一手资源尽在官方微信交流群!快快加入我们吧...

扫描微信二维码查看详情

客服E-mail:kefu@iyunv.com 客服QQ:1061981298


QQ群⑦:运维网交流群⑦ QQ群⑧:运维网交流群⑧ k8s群:运维网kubernetes交流群


提醒:禁止发布任何违反国家法律、法规的言论与图片等内容;本站内容均来自个人观点与网络等信息,非本站认同之观点.


本站大部分资源是网友从网上搜集分享而来,其版权均归原作者及其网站所有,我们尊重他人的合法权益,如有内容侵犯您的合法权益,请及时与我们联系进行核实删除!



合作伙伴: 青云cloud

快速回复 返回顶部 返回列表