Packets per Second Limitations in EC2

Post by john37386 » Sat, Oct 27, 2018, 12:41 PM UTC

spydum wrote: post #29

john37386 wrote: post #25

Earlier quoted context omitted.

By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.

I think you may be mistaken. Security Groups are stateful: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Securit... As suggested, it's very likely they hit the connection tracking limitation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-ne... I've personally witnessed teams hit this specifically for DNS (usually for internal, where you have explicitly permitted src/dst).

Post by gstaro » Sat, Oct 27, 2018, 1:04 PM UTC

spydum wrote: post #29

john37386 wrote: post #25

Earlier quoted context omitted.

By default, Amazon uses stateless firewall. It means that by default it's not tracking connections.

I think you may be mistaken. Security Groups are stateful: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Securit... As suggested, it's very likely they hit the connection tracking limitation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-ne... I've personally witnessed teams hit this specifically for DNS (usually for internal, where you have explicitly permitted src/dst).

Post by p0rkbelly » Sat, Oct 27, 2018, 3:02 PM UTC

_kp6z wrote: post #20

A more plausible explanation is that the xen networking path is simply expensive, the intel VFs are limited by queue count and silicon (i40e isn't a great ASIC), and the Annapurna part is really an ARM64 NPU. NPUs have been abandoned by most silicon vendors and have a tragic history. It's simply hard to make NPUs work right at attractive price/power/performance and at high speed versus fixed function scatter/gather I…

Post by emmericp » Sat, Oct 27, 2018, 4:39 PM UTC

_kp6z wrote: post #20

A more plausible explanation is that the xen networking path is simply expensive, the intel VFs are limited by queue count and silicon (i40e isn't a great ASIC), and the Annapurna part is really an ARM64 NPU. NPUs have been abandoned by most silicon vendors and have a tragic history. It's simply hard to make NPUs work right at attractive price/power/performance and at high speed versus fixed function scatter/gather I…

Post by rbranson » Sat, Oct 27, 2018, 4:55 PM UTC

_kp6z wrote: post #20

A more plausible explanation is that the xen networking path is simply expensive, the intel VFs are limited by queue count and silicon (i40e isn't a great ASIC), and the Annapurna part is really an ARM64 NPU. NPUs have been abandoned by most silicon vendors and have a tragic history. It's simply hard to make NPUs work right at attractive price/power/performance and at high speed versus fixed function scatter/gather I…