10

Does each packet get processed by a different core? Or is it a single-threaded process?

5
  • 2
    I'm not sure why Chopper3 closed this question. To answer it though: Iptables is really just the userspace front-end for the linux firewall which is netfilter. Netfilter is really a system of hooks in the kernel around packet processing. Each packet is processed by the kernel by triggering an interupt. Whether your kernel balances interrupts across multiple CPUs depends on how old it is. See this thread on StackOverflow about it. stackoverflow.com/questions/7467688/…
    – JakePaulus
    Nov 27, 2011 at 19:05
  • +1, because I think it is a genuine question. Nov 27, 2011 at 19:35
  • @JakePaulus This IRQ-balacing will never assign more than one core to one interrupt. So a switch of cores for each packet on a single line will never take place?
    – Nils
    Nov 27, 2011 at 20:15
  • From a CPU memory cache point of view switching cores for a single connection does not make much sense - it would propably even slow down things if these cores do not share the same cache. But why do you ask this question?
    – Nils
    Nov 27, 2011 at 20:17
  • @Nils The interrupts generated by an interface could be redirected to another, less busy CPU. Also, multiple interfaces could have their interrupts sent to different CPUs to spread the load. I think you're right about traffic from a single interface not being balanced across CPUs on a per-packet basis.
    – JakePaulus
    Nov 27, 2011 at 20:20

1 Answer 1

6

Iptables is really just the userspace front-end for the linux firewall which is netfilter. Netfilter is really a system of hooks in the kernel around packet processing. Each packet is processed by the kernel by triggering an interupt. Whether your kernel balances interrupts across multiple CPUs depends on how old it is. See this thread on StackOverflow about it. https://stackoverflow.com/questions/7467688/netfilter-hooks-on-multi-core-system

As Nils mentioned, these interrupts wouldn't be balanced on a per-packet basis. They'd be balanced per IRQ (per interface) or possibly moved altogether to different CPU if one became too busy.

1
  • alternatively you could also throttle your interrupts or affine them to different cores. I have seen in some cases, they affine all network interrupts to few cores to ensure least packet re-ordering and process migration across cores.
    – chandank
    Feb 14, 2013 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.