UT performance penalty???

[itcinc]

I have been building, swapping and testing parts and UT configurations for over a month. What I have found is that at faster network speeds unless you have HEAVY DUTY hardware the UT device is a decided performance hit. Old single-core CPUs seem to be a problem but RAM is not factor as long as it is at least 1GB. Network cards also have not been an issue as I have tried multiple Intel and Dlink versions - all new.

I have put together a new configuration using the following:

Winsis ITX case - backwards expansion card connection to the case - a definite oops but not a major problem - I like the rest of the case
Newegg.com - Winsis Wi-01 Black SGCC / ABS Mini-ITX Tower Computer Case - Computer Cases

Intel Atom 330 board - onboard NIC turned off
Newegg.com - Intel BOXD945GCLF2 Atom 330 Intel 945GC Mini ITX Motherboard/CPU Combo - Motherboard / CPU / VGA Combo

Seagate 80Gb notebook hard drive
Newegg.com - Seagate Momentus 7200.2 ST980813AS 80GB 7200 RPM 8MB Cache SATA 3.0Gb/s Notebook Hard Drive - Laptop Hard Drives

Patriot 2Gb RAM
Newegg.com - Patriot 2GB 240-Pin DDR2 SDRAM DDR2 667 (PC2 5300) Desktop Memory - Desktop Memory

Intel Pro dual NIC - purchased used on ebay
Newegg.com - Intel PILA8472C3 10/ 100Mbps PCI PRO/100 S Dual Port Server Adapter 2 x RJ45 - Network Interface Cards

Total including shipping ~ $250

Now for the problem. The box runs fine but UT has problems at the connection speeds that I have available on this cable connection. See the following for a discussion on the impact of the virus blocker.
http://forums.untangle.com/virus-blo...s-enabled.html

Following are the result of tests made today one right after the other. They test the sustained download speed for a 122MB exe file from HP. Everything is running behind a Sonicwall TZ-170W and UT is in bridged mode. Same file, same connection, downloaded to the same computer. The number provided is average speed for the download

No UT box on the network -> 10Mbits/sec

UT box w/above config with NO modules loaded -> 7.5Mbits/sec

UT box w/above config with ONLY virus blocker loaded -> 4.5Mbits/sec

As the results show there is a 25% performance hit with NO modules loaded. With ONLY virus blocker there is over a 50% performance penalty. In addition, the file is corrupted when the virus blocker is on.

I like UT and want to support it and sell it. But I also need it to work better than it is currently. I did read that there is a new 6.1 beta out today but I have not tried this.

Before you go blaming the hardware including the used Intel NIC I have experienced the same type of thing with all the other boxes and NICs tested. The only thing that I have seen work well on this connection is a new Dell R200 2.4GHz Xeon dual-core 4GB RAM integrated Broadcom NICs and 80GB hard drive. However, this is overkill for a 1 or 2 person network.

Anybody have any ideas what it will take to get this fixed? I can't imagine what is wrong that causes a 25% performance penalty just to bridge the packets. FWIW, I bet the problem is much less noticeable at lower speeds but I haven't tested that theory yet.

[proactivens]

There will be a performance hit no matter what your using. I fully expect my dual quad core xeon 2.2ghz box to handle speeds much better than a dual single core xeon system would. If you take a look at what untangle is doing here, you will see why there is a performance hit. Packet deconstruction / reconstruction. It is going to take more time to process than the sonic wall, thus creating latency. I fully expected this when I tried untangle.

The hit your describing is large, but do you have any business running a 12Mbps cable connection through an atom? Try building a core 2 duo with the same clock speed and I guarentee you will see a noticable difference. It's not going to be as cheap, but it will work better. However, for the average home user, I dont think the performance losses you posted would be unacceptable. In a business environment, yes they would be, but then again, why are you running a business off an atom?

[itcinc]

If you take a look at what untangle is doing here, you will see why there is a performance hit. Packet deconstruction / reconstruction.

The first test had NO modules loaded. What would it be doing at that point? I would assume that there would be basically a straight pass through of the data with little or no performance impact.

The hit your describing is large, but do you have any business running a 12Mbps cable connection through an atom?

I built it to see if a modern (though low-powered) processor did any better job of handling this load than did the single-core P4 machines that I had previously tried. I also assumed that I would ultimately take it home and use it there but I don't want my home 3MB DSL to become a 1.5MB connection. However, I expect that it will perform better at a slower throughput.

I can understand the performance hit if I had a bunch of modules loaded and that is the way I eventually expect to run it. Spam, phishing, web filter, virus blocker, AD connector and reports. I probably won't run VPN.

I still don't understand why virus blocker is such a performance hit. IF it ONLY scans when the file is completely downloaded why would there be ANY performance penalty UNTIL the scan started. As it is, there is an ADDITIONAL 25% penalty over NO modules (50% total) performance penalty with ONLY virus blocker loaded during the ENTIRE time the download is being processed. It gets to approximately 4.5Mbits/sec before it hit 10% and stays flat at that level. At 90% it stops the download to scan, can't complete the scan in the allocated time and truncates the file.

Try building a core 2 duo with the same clock speed and I guarentee you will see a noticable difference. It's not going to be as cheap, but it will work better.

I believe the Atom 330 is a dual-core CPU though not a core 2 duo. I know it is not as powerful as others CPUs but UT sees it as four cores during installation and rates it as "excellent".

I am interested to see what you report on the Jetway AMD board that you are in the process of building and testing.

[sky-knight]

The first test had NO modules loaded. What would it be doing at that point? I would assume that there would be basically a straight pass through of the data with little or no performance impact.

This is where your fundamentally going wrong...

Even without rack modules the UTM is still engaged. The packet is still being deconstructed, passed through the virtual rack and then reconstructed on the other side. This system is what makes it possible to run packets through all the different apps in the rack efficiently.

The fact that we have a virtual rack slows the system. However, the amount of slowing imposed by more and more rack applications is minimized. So you don't see the efficiency gains until your rack fills up.

Developers

Also, you say all downloads are corrupted by the AV module. I just downloaded AVG off download.com at over 1MB/Second and the file was just fine. I agree there is an efficiency thing to be dealt with in the AV module, but it does "work" most of the time.

P.S. This box is a P4 1.7 single core with 1gb of ram and intel pro 100 interfaces...

[hescominsoon]

UT is highly dependent on math processing..and this is where the atom falls flat. The atom is NOT a core/pentium series but a different architecture. The atom is all about power with performance as the second.

[itcinc]

Even without rack modules the UTM is still engaged. The packet is still being deconstructed, passed through the virtual rack and then reconstructed on the other side.

Thanks for the clarification and link to the developers site also helped.

Also, you say all downloads are corrupted by the AV module. I just downloaded AVG off download.com at over 1MB/Second and the file was just fine. I agree there is an efficiency thing to be dealt with in the AV module, but it does "work" most of the time.

P.S. This box is a P4 1.7 single core with 1gb of ram and intel pro 100 interfaces...

Sky, what is the type and speed of your connection? How are you measuring your download speed? How large it the AVG file and is it an executable?

I have shown that 100% of the time I have corruption with virus blocker on using this cable connection when the file is large enough - over about 60MB.
http://forums.untangle.com/virus-blo...s-enabled.html

UT is highly dependent on math processing..and this is where the atom falls flat.

There is no question that the Atom is not a performance CPU. UT apparently does not know that because in the UT detection module the Atom rates an "excellent". I suspect that the rating comes from the numbers of cores detected. However, I do like the idea of not using a lot of electricity and generating too much heat - especially at home.

I agree with you that UT is highly CPU dependent. Almost to the point that it is the ONLY thing that matters. RAM is not a problem unless you have many users and NICs and hard drives don't seem to make much difference either. Obviously, these items could make a difference in a large, busy network but they don't have any impact on the performance on my small network with few users.

I have had 4 different boxes on this cable connection and only one of them could handle the load when downloading the 122MB file. That one was a Dell R200 2.4GHz dual-core Xeon 4GB RAM. The other boxes - Compaq P4 2.5GHz 1GB RAM, Dell PE600SC P4 2.4GHz 4GB RAM and Atom 330 1.6GHz dual-core 2GB RAM - all caused significant performance reductions and corrupted the files during large file download.

[sky-knight]

Sky, what is the type and speed of your connection? How are you measuring your download speed? How large it the AVG file and is it an executable?.

Cable, 1/20mbit

57.2mb AVE Free edition download.

Speed indicator is just Firefox reporting a sustained download of just over 1MB (Megabyte) per second. I have had intermittent corruption issues at anything over 900KB per second. I haven't been able to reproduce them enough to show a cause. And I haven't seen the AV module flatten the CPU either... I have seen an increase during download but not 100%...

My largest issue is finding a download source that can consistently deliver the data at that speed to test the darn thing.

[mozerd]

RAM is not a problem unless you have many users and NICs and hard drives don't seem to make much difference either. Obviously, these items could make a difference in a large, busy network but they don't have any impact on the performance on my small network with few users.

In my lab testing I found that the quality of the NIC's used is extremely important especially if you want to have a stable network running under Untangle as a router with segregated subnets. That is not to say that NIC's need to be expensive but they do need to be properly tested THEN stay with the ones that prove to be reliable under load. If the motherboard FSB is rated at X then the RAM performance needs to be as close to X as one can afford. And Absolutely no question that SATA drives are far superior to IDE drives especially the SATA drives configured to operate at 3G versus 1.5G. Untangle preforms much better when all the components are working as close to optimum as possible even for very small networks. Layer 7 processing imposes a significant load on the underlying infrastructure [computer system Untangle relies on to run] and Untangle does preforms much better when one respects that aspect.

[itcinc]

Sky,

That 57.2mb is just under the size where I have seen corruption. Around 50MB to 60MB it is borderline. Above ~ 60MB I have had problems 100% of the time.

From the link below try downloading part 2 near the top - size is 121.8MB. I would like to know what kind of speed you see and if the file is corrupted.
HP ProLiant DL380 G4 Server series*-* Download drivers and software - HP Business Support Center

[proactivens]

Atoms are low power, low cache, low clock speed processors. I know the 330 is a dual core. Compare the performace of a dual core atom to a core2duo of the same clock speed and you will get better performance. Compare that number to the performance of a dual core xeon or opteron and you will get better performance yet. Server class processors are built to crunch numbers, handle relational databases, complex algerithems, ect. That is what untangle does. Complex math. You need to give it an engine that can handle that math.

Look at it this way, who would you rather do your taxes? A 6th grade math student (atom), a freshmen math major (core 2 duo) or a math major with a masters degree (xeon)?