Hi people!
A few weeks ago, i read on the pfsense RSS feed about a “Ding-Dong Ditch” “bug”, happening on FreeBSD since 2017. Taking a few extra CPU cycles for every packet going through it. Reading the article there is a fix for it, and then even an optimization. Making it free up CPU cycles and significantly improving packet processing efficiency.
I don’t know when this will be available but this actually got me thinking that this should extend the lives of our current pfsense boxes by a significant amount, maybe even lowering the class of hardware needed to run certain workloads/speeds. Considering things are extra expensive I think this is a very big win. Maybe even freeing CPU cycles for higher throughput/lower energy usage for, let’s say, FQ_CODEL.
Any thoughts on this optimization? I couldn’t find any posts talking about this. If you left pfSense, would this optimization persuade you to set it up on your network again? Maybe revive an older box?
I appreciate any 2cents from anyone knowledgeable on the topic as i am pretty excited to update my pfsense when this becomes available. Am i over-excited?
Thanks!
1 Like
I think PFsense used to be the go-to for many on this forum about 4-5 years ago. I think some still use it but I have since moved on. I wont rehash the reasons why. I’ve already communicated that enough on here.
It does look interesting, but not enough for me to go back to it. OPNsense will get the update eventually and most users will wait for that to happen, but not switch. The linux kernel never had this problem so VyOS and Unifi were in the clear.
A full gigabit of normal traffic is roughly 80,000 packets per second. The broken code already forwarded about 960,000. A modest homelab or small office, even on 2.5 GbE, stays far below that. Each packet did waste two slow register writes, so you get a little CPU back. At homelab rates that is about a couple percent of one core.
All that to say, it matters if you push multi-gigabit of tiny packets, or the box is already near 100% CPU. For ordinary home and small-business traffic, you will not notice it.
Thanks for the reply!
Indeed the narrative around things was a bit different 4-5 years ago. That was also around the time that i started paying attention to privacy and security within the interwebs and started learning, Tom’s videos were one of my teachers then. That was also around the time the 6100 came out so timing did it for me and i got it. Now i have and want to use all of it!
I have considered the unifi ecosystem, but since i just have to manage my home and like to tinker and control things, the unifi ecosystem although more convenient, seems more closed and limited with what i wanted in one box. I am still happy with pfsense, maybe ignorance is being a bliss for me here.
Unifi also seems to be doing things well, but i do wonder, when and if, they will follow the classic greedy company process. This might be also happening on Netgate, but with the competition i think we are keeping them a bit more on their toes.
You also opened my eyes eyes for, unless you’re maximizing the appliance’s CPU with your traffic, you won’t notice a difference with usage, maybe a few % on the numbers.. I’ll keep my excitement a bit more realistic. I was though, tinkering with FQ_CODEL and on my Netgate 6100, when doing simultaneous 900Mbps up and down buffer-bloat tests, the CPU would get maximized and traffic would go haywire. Also in this case, synthetic and unlikely traffic load. But still having iflib clearing some unnecessary CPU cycles, maybe the FQ_CODEL ceiling will increase and give me a very clean shaping on close to Gbit speeds in both directions simultaneously. Which would be nice. I am also thinking here on Tom’s tests with iperf with this specific box, where one stream would maximize at ~2.31Gbit/s. Surely this number, after the patch, should increase. But then again, will this be noticeable on normal daily traffic?
Anyway, i wrote a lot and just wanted to put some thoughts for discussion. I might the old guy ruminating about the old good times and everyone has already moved on and that’s okay! Thanks for reading! 
I liked the good ol days. I deployed over 20+ netgates for a company and in data centers. I was a fanboy for sure and spread the word that it was a great product. But now, I simply don’t recommend them. The good thing about UniFi is they built their infrastructure on letting the user own the hardware and software. If they decided to cut that off from the users then people won’t update their controllers and devices. But will eventually suffer due to not getting security patches.
Do you mind specifying what keeps you from recommending pfsense (maybe pfsense+) at all at this point or point to where you have already talked about it? I understand the + version is more feature/update rich. But I guess Netgate, like any company in a position, will want to give a reason for consumers to choose their product and will want to collect their fruits. Unfortunately, it is the nature of doing it at all.
That’s also why i am leaning, more and more, towards open source. Actual open source. Hell, i even mind it less when there are certain bugs or limitations on open source than on something backed by a company and paid for. The expectation changes a lot, at least for me. Open source feels like labor of love, close sourced feels like greed.
With that being said, i have thought on setting up an older computer with OPNsense, on bare metal, let’s go all in in here. haha. It would be the router software backed up by a very strong horse. But maybe too much of a horse with too much of an energy print. We gotta keep things somewhat efficient here! 
I’ve expressed this in great detail on this forum. The gist is I’ve always advocated for companies to make money on their products to support open source because I don’t have the time to help code contribute. I’ve bug tested and filed bug reports and worked with netgate. However, what they have done to their community has caused a big rift with me and others. Pushing users to upgrade to the plus edition which lead to a bait and switch. Now the pfsense download is locked behind a netgate account. Lastly the lack of support for community edition and barely giving it any attention. Basically giving it security patches and calling it good. I think they know the damage they have done to the community that built pfsense.
The greed you mentioned is happen in netgate. It’s only a matter of time before they cut off the CE of pfsense.
1 Like