Some interesting MT mipsbe performance results

[barkas]

Disclaimer: All this was done on the quick with iperf, so take it with a grain of salt.
OS was 6.1

Setup was IBM Laptop 1 ↔ MT Router ↔ Netgear GS108T ↔ IBM Laptop 2
Reference was bandwidth over a Netgear GS108T, which netted me 936Mb/s.

After that I inserted the MT router, first was a RB951G-2HnD, config was blank at the start. I just assigned 2 different IPs to interfaces, plugged the laptops in and did a straight up routing performance test.

Result routing no firewall: 915Mb/s
Result routing 1 firewall rule (permit any any): around 400Mb/s
Result routing with a NAT rule (masquerade): around 320Mb/s

Second test object was a RB450g I have long used as a test box, with metarouters and all that. So I disabled the metarouters and switched eth1 to a direct IP instead of the bridge servicing the metarouters, too.

Result routing no firewall: 737Mb/s
Result routing no firewall former bridge config restored: 737Mb/s
Result routing 1 firewall rule (permit any any) former bridge config restored: 264Mb/s
Result routing no firewall former bridge config restored with metarouters: around 200Mb/s
Result routing 1 firewall rule (permit any any) former bridge config restored with metarouters: around 100Mb/s

While I don’t claim that these results are representative, they do show the general area of performance of these things.
It is, not very much to my surprise, not anywhere near what MT claims to have tested.

I hope to find the time to repeat those tests in the future using a Spirent AX9000 but it’s not certain I will get that chance.

@MT: Any comments?

[tomaskir]

@barkas

It is, not very much to my surprise, not anywhere near what MT claims to have tested.

Here is how MikroTik tests their equipment, this will allow you to replicate the performance numbers claimed by MikroTik.
http://wiki.mikrotik.com/wiki/Manual:Performance_Testing_with_Traffic_Generator

[barkas]

@tomaskir

@barkas

It is, not very much to my surprise, not anywhere near what MT claims to have tested.

Here is how MikroTik tests their equipment, this will allow you to replicate the performance numbers claimed by MikroTik.
http://wiki.mikrotik.com/wiki/Manual:Performance_Testing_with_Traffic_Generator

You should know that the mipsbe devices are nowhere near fast enough to generate the traffic to test anything.
Besides:

@routerboard.com

All tests are done with Xena Networks specialized test equipment (XenaBay),and done according to RFC2544 (Xena2544)

[tomaskir]

@barkas

You should know that the mipsbe devices are nowhere near fast enough to generate the traffic to test anything.
Besides:

@routerboard.com

All tests are done with Xena Networks specialized test equipment (XenaBay),and done according to RFC2544 (Xena2544)

Yes, however the wiki states:

@wiki.mikrotik.com

This article shows necessary configuration and hardware to replicate the tests published in routerboard.com.

The DUT in the wiki article can easily be a mipsbe device, just the trafficgen needs to be more powerful.

[barkas]

@tomaskir

@barkas

You should know that the mipsbe devices are nowhere near fast enough to generate the traffic to test anything.
Besides:

@routerboard.com

All tests are done with Xena Networks specialized test equipment (XenaBay),and done according to RFC2544 (Xena2544)

Yes, however the wiki states:

@wiki.mikrotik.com

This article shows necessary configuration and hardware to replicate the tests published in routerboard.com.

The DUT in the wiki article can easily be a mipsbe device, just the trafficgen needs to be more powerful.

The 951G is the most powerful mipsbe device. Anyway I did explicitly state that my test methodology is not perfect. I hope to retest in the future with a spirent or agilent loadgenerator.

Anyway, further investigation showed that activating a firewall rule while disabling conntrack has a minor performance hit only. The real performance hit comes from the auto activation of connection tracking that is the default configuration. I therefore assume that the performance numbers on routerboard.com were generated with disabled connection tracking. Not really a sane configuration for a firewall, though it can be for a router.

So, the two biggest slowdowns come from connection tracking and metarouter.