Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a minimal CentOS 6.3, 64 bit acting as gateway with 4 NIC (1 Gbps), each bonded together one for public traffic and other for private, which performs NATing. It has 6 GB RAM and 4 logical cores. We have been using this for the past two years without any problems.

I don't have any experience with hardware routers, but I have heard that they have less RAM and CPU and use flash disks. How can a box with low hardware configuration perform better (as in, handle more concurrent connections) than a machine with more RAM and CPU?

What are the limiting factors, other than IOS using different methods to handle this?

share|improve this question
2  
Implementations in Hardware are faster then firmware is faster than software for the same solution. –  mdpc Mar 28 '13 at 5:25
2  
The "better specs" you mention are irrelevant for the job at hand. There are other properties that actually matter. –  ndim Mar 29 '13 at 14:21
    
Ok, so... from what you wrote, should I assume that your Centos is a virtual machine? Aside for special network optimizations for virtual machines, both on hypervisor and on guest sides, virtual machines are generally known not to be good in this kind of role... for usage as a router/firewall, bare metal is always recommended! –  stoned Apr 23 at 12:17
    
Are you actually routing 1Gbps of traffic as suggested by your configuration? You may be using a dumptruck to move a shovel full of sand. 6GB of RAM and 4 cores are basically never going to be touched for a router, you could save electricity and rack space by using a small Intel Atom machine to do this job. –  Bert Apr 23 at 13:15

4 Answers 4

up vote 57 down vote accepted

ASICs.

Instead of using a general purpose CPU and task-specific software, you can skip the software and just make the silicon handle the task directly.

High performance networking hardware uses ASICs instead of software for the computationally heavy (but relatively logically simple) tasks of something like comparing an IP address to an enormous internet routing table, checking a CAM table for a switching decision, or checking a packet against an ACL. This makes an enormous difference in the speed of those time-sensitive operations, providing a significant advantage over a general-purpose CPU.

share|improve this answer
    
while i agree with shane, i would choose iptables running on a generic server over an appliance any day. in my company, iptables running on fedora is faster, more flexible, simpler to configure, less taxing on cpu and memory, quicker to boot, and way cheaper than our cisco asa. –  rvh Mar 28 '13 at 20:45
    
@rvh: for firewalling or just routing ? –  Kwaio Apr 23 at 11:51

A high-end, dedicated router can outperform a PC with a faster CPU and more RAM because it it can do more of the routing in hardware.

It's the same reason a $60 Gigabit Ethernet switch can outperform a $2,000 PC with 4 two-port GigE cards acting as an Ethernet switch. The switch is built from the ground up to be a switch.

share|improve this answer
3  
And since the dedicated router is running on a flash disk, there are fewer moving parts to fail at inopportune times. –  cpt_fink Mar 28 '13 at 4:16
    
I'm not really sure you are right. I have had created a very basic anti-DDOS protection for a company I worked based on netmap (info.iet.unipi.it/~luigi/netmap) and it performed very good even on normal hardware (really full 1Gb/s or 11M packets/sec). There is also a version of openswitch for netmap on that site that can forward 3M packets/sec on "normal" hardware, I don't know any cheap (500$) switch that can do it, but I may be wrong. –  XzKto Mar 28 '13 at 7:58
1  
@XzKto A typical cheap ($60) 5 port GigE switch can forward packets between all combinations of ports at full wire speed. They typically uses a full, non-blocking crossbar. –  David Schwartz Mar 28 '13 at 13:29
    
@XzKto What David meant is, unlike the PC which will handle "up to its own interfaces throughput" speed, the switch does if for every combination of port-to-port. You can have host1 talking to host2, and 3 to 4, and each connection at full duplex & maximum throughput. You can't beat that. (and for more money, more ports, even easier to see why it's faster). And for router, it is kind of similar: hardware will be able to reroute faster than software, as it can reroute as soon as it have enough information (your linux router will do it at each layer, but getting there will already be slower) –  Olivier Dulac Mar 28 '13 at 18:50

"Other than IOS" ?

IOS makes almost all the difference. CentOS is a general-purpose operating system. It's designed to perform well enough under a very wide range of scenarios, using a vast array of different hardware configurations. IOS on the other hand is extremely fine tuned to handle only the kind of workloads you would expect from a piece of network equipment, using the very specific types of hardware you would find in Cisco gear.

Knowing exactly what pieces of hardware you're programming for will take you a very long way in terms of performance vs. compatibility.

share|improve this answer
2  
+1. Add to that the fact that Cisco has the engineering resources and know-how to replace software with hardware when needed. Meaning, if a particular operation is slower than they'd like in software, they can put effort into engineering an ASIC, adding instructions to their existing processing units, or build a hardware module to help speed it up. The tables tip overwhelmingly in favor of performance when you have the luxury of controlling both the software and the hardware. –  Justin ᚅᚔᚈᚄᚒᚔ Mar 28 '13 at 14:54
    
It works both ways, too. The hardware doesn't need to deal with rare, complex cases either. It just throws those to software. Routing loops? Don't try to figure out in hardware how to deal with those. –  MSalters Mar 29 '13 at 10:35

Both software and hardware have something to say. I have the comparison of Intel and TP-Link NIC (which uses a Realtek chip at its heart) on generic server hardware, as well as purpose-built and generic-purpose software in routing.

On the hardware side, if the ASIC on board can do some handling of IP traffic, the processor load can be lower and thus faster. I have noticed the two onboard INtel NIC chips communicating directly by DMA, bypassing main CPU in handling packet forwarding; meanwhile the Realtek chip interrupts whenever a packet arrives.

On the software side, if the software is designed to be used in routing, it can be made more efficient. I have used both pfSense+PF (a modified FreeBSD intended to be used as a router) and generic-purpose Ubuntu 12.04+iptables as routing software and the first clearly switch traffic a lot faster. (Ubuntu 14.04 is now almost as fast, thanks to the new nftables in Linux 3.13 kernel.)

However dedicated router do have one major drawback: it cannot perform much other than switching traffic, and it cannot be virtualized. My current edge router is a virtual machine inside my ESXi cluster running Ubuntu 14.04, and it also acts as an intrusion detection system and load balancer.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.