On 2009-08-13, Wijnand Wiersma <wijnand@videre.net> wrote:
quoted text
> When investigating I see 80-90% of the CPU time is because of interupts.
> Almost all interrupts  are for the rl0 and rl1 interface.
>
> The interrupt load is not coupled to bandwith usage, we can use 60Mbit  
> without any problems.
> I know rl(4) cards are crappy but I am wondering what could cause  
> these strange spikes?
> It must be because of packets per second, but I can't find a offender.  

almost certainly high PPS. you can watch the traffic with "systat ifs",
maybe when you hit a high-load spike you could tcpdump and identify the
actual traffic. (or setup pflow and nfdump/etc).

quoted text
> Are there any tweaks to mitigate the effects?
>
> Right after the load spikes (normally these last for 15 minutes) the  
> IPSEC tunnels are not in a usable state anymore.
> Does anyone have a workaround for this?

either of these options would probably help, but might not
be (possible|practical):

- use a faster cpu
- change the nic; almost anything else would be better
- convert the rl(4) driver to use MCLGETI
- identify the cause of the packet flood and apply lart(8)
http://www.xinu.nl/unix/humour/asr-manpages/lart.html