FreeBSD下提升网络性能

Procedure for raising network limits under FreeBSD
All system parameters can be read or set with 'sysctl'. E.g.:

sysctl [parameter]
sysctl -w [parameter]=[value]
You can raise the maximum socket buffer size by, for example:

1	sysctl -w kern.ipc.maxsockbuf=4000000

You can also set the TCP and UDP default buffer sizes using the variables

1 2 3

net.inet.tcp.sendspace net.inet.tcp.recvspace net.inet.udp.recvspace

When using larger socket buffers, you probably need to make sure that the TCP window scaling option is enabled. (The default is not enabled!) Check 'tcp_extensions="YES"' in /etc/rc.conf and ensure it's enabled via the sysctl variable:

1	net.inet.tcp.rfc1323

FreeBSD's TCP has a thing called "inflight limiting" turned on by default, which can be detrimental to TCP throughput in some situations. If you want "normal" TCP behavior you should

1	sysctl -w net.inet.tcp.inflight_enable=0

(FreeBSD默认打开了"inflight limiting"特性，此特性在某些情况下对TCP的吞吐能力不利，可以把它禁用)
You may also want to confirm that SACK is enabled: (working since FreeBSD 5.3):

1	net.inet.tcp.sack.enable

MTU discovery is on by default in FreeBSD. If you wish to disable MTU discovery, you can toggle it with the sysctl variable:

1	net.inet.tcp.path_mtu_discovery

Contributors: Pekka Savola and David Malone.
Checked for FreeBSD 5.3, May 2006


Path MTU Discovery 允許傳輸大於 1280 位元組的 IPv6 封包。
PMTU (Path MTU) Discovery:
http://www.netheaven.com/pmtu.html

something about PMTU discovery
PMTU (Path MTU) discovery tries to find the maximum PMTU value between the connection end points, so that there is no need for fragmentation. The usage of PMTU discovery requires that the end points need to be able to receive ICMP messages from any intermediate device located in the communication path.

It is recommended to avoid fragmentation because of network efficiency. The network is used in most effecient way when there is no fragmentation because if one fragment is lost, the whole packet is lost, i.e. the effects of packet loss is multiplied whenever fragments are used. Furthermore, the network is used in most efficient way with large packets because the processing overhead is calculated per packets (not per bytes!) in most devices.

PMTU discovery can be used together with StoneGate VPN so that the end points reduce the MTU size automatically when sending traffic into the VPN tunnel. If PMTU discovery is not used, the IPSec packets may get fragmented because VPN usage adds new headers into the packet and thus these packets are larger than non-encrypted packets. If the non-encrypted packet is already using the maximum size of an Ethernet packet (1518 bytes), the additional IPSec header would not fit into an Ethernet frame any more. However, when PMTU discovery is used and packet size is decreased correctly, the additional IPSec header is accomodated without exceeding the maximum size of an Ethernet packet.

Here is a short description what happens in site-to-site VPN scenario when PMTU discovery is enabled:

1) StoneGate firewall receives an MTU size of packet (DF bit set) which needs to be encrypted.
2) Because the packet would not fit into an Ethernet frame with IPSec header and the DF bit is set, StoneGate firewall will send an ICMP error message code 3, type 4 (Destination unreachable, Fragmentation needed and DF bit set) back to the originator of the offending packet.
3) The TCP/IP stack of the originator adjusts it's PMTU information based on the ICMP message, and uses the updated information while re-sending this packet and any other packet after that.
4) All the following packets are small enough so that they can be encrypted (IPSec header can added) and sent to the remote security gateway without fragmentation.

If PMTU is disabled, the packet is handled as follows:

1) StoneGate firewall receives an MTU size of packet (DF bit set) which needs to be encrypted.
2) StoneGate firewall encrypts the received packet without fragmenting it because the DF bit is set. However, the IPSec packet can be fragmented, and it will be fragmented so that it will fit into an Ethernet frame outside the firewall.
3) The fragmented IPSec packets are sent to the remote security gateway.

Note! If PMTU discovery is disabled in the host properties (registry in Windows, ndd /dev/ip in Solaris), then that end of the communication does not tell local MTU information as a part of TCP handshake. In that case, the host uses typically packet size of about 500 bytes.

文章来自: PSC
标签: 性能 FreeBSD 网络