[lboucher]

Hi,
Short version:
--------------
I experienced microlag on a video game, and I'm pretty sure that it was caused by the number of l7filter I have declared on the qos (fifteen l7 filters, five port filters and two mac filters)

1) Just to understand, l7filter are regexp ? are they causing cpu load or i/o load ? or just response time consumming ?

2) Is there a big difference in term of performance between l7filter and the other filters ?

3) best practice would be just adding filters one by one when needing ? and prefering port filters to l7filter when they can do the job ? (for dns query for example)

Thanks!

The long story:
---------------
I saw this on my Buffalo WHR-G300Nv2 (400mhz) with BrainSlayer-V24-preSP2 r21286

I have configured the Qos with HFSC (but did the test with HTB), the bandwith defined between 80/85%, tcp congestion vegas (but did tests with others)

My son plays Smite and needs a ping < 150 ms. So, I add a service on the 9xxx port into the exempt class, to keep an ultra small latency, and it's working very well. (alone, his ping start at 70ms, and with full load on bandwith, it grows to 110ms. Without qos, it jumps more than 350ms)

But, first, I had configure something like 20 rules based on the native l7filter (for other things, like youtube, http, gif,...). And when I was surfing on press website (lots of url, images, dns query...) my son was experiencing micro lag.

Too short to see the ping counter growing on the game, or the cpu conter on the console. But those microlag was unacceptable for him and caused him to lost battle.

After many, many tests, I realized it was caused by the number of filters.

I kept only four l7 filter and three port filter and two mac filter, and everything is fine now.

[bofh999]

if he looses battles hes is doing it wrong, if he usses tactics his ping dont matter that much )

That said, yes of course more rules will cause in - higher cpu load and bit higher latency - if the cpu is faster less lag

as it goesd for any firewalling, routing and qosing - every rule has to be checked one by one until its got a go

thats why you should define the most common rules on top - the sequence matters

so keep the rules right, move the most matching or most important up, or get a better router

if thats important maybe a self builded linux box might server you better

[lboucher]

[lboucher]

OK, after digging into the subject I found this:
http://l7-filter.sourceforge.net/performance

and of course, here http://l7-filter.sourceforge.net/protocols all is explained (the speed paragraph), but on my first reading, I didn't understand all

My own brain filter select the most important things on first reading, and the details on subsequent readings