[21938] in bugtraq
Re: UDP packet handling weird behaviour of various operating systems
daemon@ATHENA.MIT.EDU (aland@striker.ottawa.on.ca)
Fri Jul 27 13:53:35 2001
To: Michal Zalewski <lcamtuf@gis.net>
In-Reply-To: Your message of "Thu, 26 Jul 2001 21:30:01 EDT."
<Pine.LNX.4.21.0107262125470.747-100000@nimue.bos.bindview.com>
Cc: bugtraq@securityfocus.com
Date: Fri, 27 Jul 2001 10:53:25 -0400
From: aland@striker.ottawa.on.ca
Message-Id: <E15Q8zW-0006gF-00@giles.striker.ottawa.on.ca>
Michal Zalewski <lcamtuf@gis.net> wrote:
> Try the same via loopback device - should not work. I believe this is not
> Linux kernel UDP handling problem. It might be, as suggested, but
> something between hardware and software, instead (like "IRQ congestion"),
> and probably should work for everything - TCP, ICMP?
At the last Linux Kernel Summit, Jamal Hadi Salim had a proposal for
speeding up packet handling in the 2.5 kernel. The issue is currently
that each packet coming into a network interface triggers an
interrupt. It's the interrupt servicing overhead that is slowing the
machine.
The proposal for 2.5 was to disable interrupts on an interface after
the first packet, and use other methods for noticing and grabbing the
later packets. There are other operating systems (QNX, etc) that do
this already.
Jamal's tests showed that removing this overhead drastically sped up
the network response, and removed much of the CPU overhead.
> Of course I can be wrong - all I say is that I was not able to
> reproduce this behavior in my test network, maybe because it is 10
> Mbit,
Implementations which appear to work under small loads may not scale
to higher loads.
Alan DeKok.
