perfSONAR User Q&A and Other Discussion

[Mark Feit <>]

Hyojoon Kim writes:

“lsmod" command shows that nf_conntrack-related kernel modules become loaded after the perfsonar security package installation, along with several iptables rules. After this happens, bwctl measurement will never go over 700Mbps when the test is initiated from the LIVA X box. Flushing the iptables rules and disabling the nf_conntrack-related modules fixes the issue, restoring the bwctl measurement to 940Mbps. 

Can someone confirm this? 

I can’t confirm it for the LIVA because I don’t have one, but iptables is well-known to be a drag in high-traffic situations.  You won’t notice this as much on bigger machines because they tend to have enough horsepower that the extra processing time doesn’t matter.  Your change effectively disables all of it, so the increase in throughput makes perfect sense.  The tradeoff is that the machine is no longer protected from the outside.

Iptables processes the rules in each chain in the order they appear, and the perfSONAR chain isn't arranged to get time- and rate-sensitive traffic processed as quickly as possible.

I wrote a bug on this:  https://github.com/perfsonar/toolkit/issues/82. 

—Mark