2

I have established a IPSEC tunnel ( standard configuration , with ESP) , on two Linux machines (centos6 , core i7) communicating over 1 gbps LAN , and i'am checking the communication throughput. It never goes higher than 400 MBps.

Is there any parallel implementation of IPSEC, that can utilize all the cores of the machine and increase the throughput?

  • 1
    Are you sure IPsec is the bottleneck ? – Romain Clair Jan 5 '16 at 14:05
  • Yes , without using the IPSEC tunnel i.e plaintext , its around 800 mbps – Ijaz Ahmad Khan Jan 5 '16 at 14:06
  • 1
    Encryption isn't supposed to be parallelized. There are some white papers on embedded proposals/implementations, but not for standard Linux. I'm surprised at how much of a slowdown you're seeing. I wouldn't expect half. – RoraΖ Jan 5 '16 at 14:16
  • I guess it depends on how fast the CPU can encrypt data on one end, and how fast the other CPU can decrypt data on the other end, I suggest attempting some benchmarks on both systems and see how much data can you encrypt/decrypt per second, I think that's your bottleneck, based on this, you can pick the algorithm that suits you better – ComputerSaysNo Jan 5 '16 at 15:05
  • By CPU , you mean just one core , or all the cores? i don't know how ipsec uses the cores. It just run on one core or all the cores? – Ijaz Ahmad Khan Jan 5 '16 at 15:46
4

Is there any parallel implementation of IPSEC that can utilize all the cores of the machine and increase the throughput. ?

I don't think that current implementations will encrypt data from the same data stream (connection) in parallel and it would only possible for selected ciphers anyway. That means it would not be possible for CBC ciphers since the encryption of one block depends on the encryption of the previous block.

But you could of course have multiple data streams (i.e. connections) in parallel and in this case the encryption of these streams will be done in parallel too. Thus it should be possible to reach a higher total throughput than you have. See benchmarks from libreswan where they reach several Gbit/s throughput when tested with iperf. You will also see in these benchmarks that the possible throughput highly depends on the cipher in use.

  • „You will also notice that the possible throughput highly depends on the cipher in use.¯ +1 absolutely ! – ComputerSaysNo Jan 5 '16 at 15:07
  • So is there any parallel implementation of some good cypher inside ipsec? :P – Ijaz Ahmad Khan Jan 6 '16 at 14:02
  • @IjazKhan: to quote myself "I don't think that current implementations will encrypt data from the same data stream (connection) in parallel" – Steffen Ullrich Jan 6 '16 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.