I have a Mikrotik 951G-2HnD router. I suspect it is the bottleneck of my network why I cannot reach Internet with 500Mbps/20Mbps what my ISP should provide. I would like to know what can cause this: configuration of my device or hardware failure.
I can measure maximum 100-120Mbps download speed even if I am connected to my Mikrotik 951G-2HnD device directly with CAT5e cable.
To make sure, not my ISP is the guilty, I connected a PC to the WAN port and did measurements between that WAN side PC and another one in my LAN but I could measure the same speeds so it seems my router is the bottleneck somehow.
What my router do?
NAT (DHCP client on WAN)
IPv6 tunnel
DHCP server
L2TP VPN and OpenVPN site2site VPN (less then 5 clients and minimal traffic between my flats). L2TP VPN is configured as Layer2 connection because of DLNA server in my primary flat.
Two WiFi network (guest SSID with only internet and “normal” for the family)
Two tagged VLAN network (guest and “normal” as in case of wifi). Trunk VLAN cable towards my smart switch where all the PCs are connected.
I have checked the CPU usage when I’m measuring but it’s under 90% always.
I have just added the above two fasttrack firewall rules and my connection immediately because 2 times faster then before so this was definitely the problem. Big thanks!
Just to make sure I understand correctly: they should be at the top of my firewall rules, right?
Mkx, you mentioned 500Mbps is the edge of what this device can deliver. Can you suggest a similar device what is good up to 1Gbps/1Gbps connection? 2Gbps/2Gbps is the max what my ISP offers but half of it is more then enough for me even if I take into consideration my multi-homed life too. If my device would have a higher capacity at an affordable price, even better of course. (I don’t know where I can find this kind of info in the catalogs)
In case of RB951G-2HnD device, “Routing, 25 ip filter rules, 689.8 Mbps” is shown under the test results for 1518 byte packet size.
Does this mean, that if I have just 25 IP filter rules (under IP / Firewall / Filter Rules), then I should be able to reach this throughput without fast track rules? Well, in my case, with no fast track rules, I could reach a much worst speed, however, I have actually exactly 25 (with the 3 disabled ones).
*) All tests are done with Xena Networks specialized test equipment (XenaBay),and done according to RFC2544 (Xena2544)
Max throughput is determined with 30+ second attempts with 0,1% packet loss tolerance in 64, 512, 1518 byte packet sizes
Test results show device maximum performance, and are reached using mentioned hardware and software configuration, different configurations most likely will result in lower results
Translation: These results are reached only within ideal and specific conditions, this is the maximum which is unreachable in other setups.
You should read this the same way as car fuel consumption, electric car drive distance, display contrast, WiFi speed, …
Just use these numbers to compare the huge performance difference of both devices an upgrade if you need better router.
My rule of thumb is to look at number for most loaded firewall (i.e. the lowest line in the table) and packet size of 512 bytes. My feeling is that this number gives best approximation for max performance for typical SOHO use.
Surely if one gets overboard with number of rules (we’ve seen some examples on this forum), then performance might be even lower.
When squeezing router for every last bit of performance, the order of filter rules does matter and can bring a few percent of performance.
Hello. I have exactly the same problem. ISP gives 300Mbit, but my maximum with 951G-2HnD is around 150Mbit. Fasttrack rules don’t help, the only difference is CPU load becomes lower: ~30% with fasttrack rules and ~90% without (with queues). Any suggestions what it can be? Generally speaking, can speed be limited somewhere else except queues? Because it doesn’t look like a hardware limitation. But review of exported config showed me nothing suspicious.
This solution http://forum.mikrotik.com/t/strange-limit-to-throughput/87608/1 didn’t help (changed pfifo for ethernet-default, changed only-hardware for lan and wan interfaces with ethernet-default)
This solution http://forum.mikrotik.com/t/rb951g-2hnd-wan-to-lan-performance/96164/1 didn’t help either (used another media converter, both are 1Gbit, used different SFPs)
Do you happen to have a fast ethernet device connected to one of the LAN ports? Not the one from which you measure the speed, some other one which is also connected while you run the test.
There’s nothing connected directly to Mikrotik’s ports except 1Gbit fiber media converter (ether1) and 1Gbit Cisco switch (ether2). There could be 100Mbit devices somewhere in the network though. Can you tell more how and why they can be the cause of my problem?
Not in your case. Some switch chips have performance problems if they have to adapt between different rates on different ports (e.g. one port 100M, another 1G), affecting not only traffic between pair of ports with mismatched speeds but also the rest of traffic. It seems AR8327 (which is part of SoC used in RB951G) suffers from this problem to certain extent as well.
In your case most likely RB951G is simply too slow to handle the traffic. You mentioned queues, which means no fasttrack. If there’s IPv6 in the mix: ROS doesn’t fasttrack IPv6 so far. All of that means high hit on CPU.
The switch chip tells the CPU not to send more packets until it manages to deliver the one being currently processed. It is theoretically possible that the pause frames would be sent by downstream switches, but it is not very likely.
On the other hand, it is still strange as you say that the CPU load is only about 30 % with fasttracking. So maybe try disconnecting the rest of the network and see whether it helps?
On yet another hand, where do you see those 150 Mbit/s? In some speedtest application or in output of /interface monitor-traffic output? Could it be that the connected network devices also download some data (or upload them, the total load matters, not the direction) while you are testing, so the speedtest only gets the rest of the bandwidth?
No idea then. What does the Status tab show? The last thing to come to my mind would be that it somehow managed to negotiate half-duplex on the Gigabit interface…
sindy
I’m terribly sorry, but it happened to be an ISP issue. After N-th call to the support they fixed the speed, which obviously somehow somewhere was left locked to previous 150Mbit limit. As some valuable addition to the thread I can say, that fasttrack rules aren’t strictly required in my case: if there’s no queues I still get 300Mbit despite 100% CPU load. With fasttrack rules CPU load is under 60%. With a single simple queue speed drops to <180 Mbit.
Many thanks for participation in solving
