10

Does each packet get processed by a different core? Or is it a single-threaded process?

5
  • 2
    I'm not sure why Chopper3 closed this question. To answer it though: Iptables is really just the userspace front-end for the linux firewall which is netfilter. Netfilter is really a system of hooks in the kernel around packet processing. Each packet is processed by the kernel by triggering an interupt. Whether your kernel balances interrupts across multiple CPUs depends on how old it is. See this thread on StackOverflow about it. stackoverflow.com/questions/7467688/… – JakePaulus Nov 27 '11 at 19:05
  • +1, because I think it is a genuine question. – Sachin Divekar Nov 27 '11 at 19:35
  • @JakePaulus This IRQ-balacing will never assign more than one core to one interrupt. So a switch of cores for each packet on a single line will never take place? – Nils Nov 27 '11 at 20:15
  • From a CPU memory cache point of view switching cores for a single connection does not make much sense - it would propably even slow down things if these cores do not share the same cache. But why do you ask this question? – Nils Nov 27 '11 at 20:17
  • @Nils The interrupts generated by an interface could be redirected to another, less busy CPU. Also, multiple interfaces could have their interrupts sent to different CPUs to spread the load. I think you're right about traffic from a single interface not being balanced across CPUs on a per-packet basis. – JakePaulus Nov 27 '11 at 20:20
6

Iptables is really just the userspace front-end for the linux firewall which is netfilter. Netfilter is really a system of hooks in the kernel around packet processing. Each packet is processed by the kernel by triggering an interupt. Whether your kernel balances interrupts across multiple CPUs depends on how old it is. See this thread on StackOverflow about it. https://stackoverflow.com/questions/7467688/netfilter-hooks-on-multi-core-system

As Nils mentioned, these interrupts wouldn't be balanced on a per-packet basis. They'd be balanced per IRQ (per interface) or possibly moved altogether to different CPU if one became too busy.

1
  • alternatively you could also throttle your interrupts or affine them to different cores. I have seen in some cases, they affine all network interrupts to few cores to ensure least packet re-ordering and process migration across cores. – chandank Feb 14 '13 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.