Is this Poor Performance?

[Littlejohn2003]

I have a PIX 515E, 3 interfaces (inside, DMZ, outside)

I'm using the Testfile program included with the NUTS program suite from Yizhar to test network performance.

Here's what I get when I go from the inside to a server on the DMZ. (running the program from a server on the inside segment making the Testing Work Path a file share on the DMZ). I chose Test File Size to be 20MB and checked "Integrity Check while reading"

This is what I got on the Program:

Testing Save File Speed:
Starting at 8:55:58 AM
Finished at 8:56:51 AM
Time Elapsed = 52,468 ms

Calculated Save Speed =
399,701 Bytes/Second


Waiting 2 seconds for system to relax...


Testing Read File Speed and Integrity:
Starting at 8:56:53 AM
Finished at 8:57:41 AM
Time Elapsed = 48,016 ms

Calculated Read Speed =
436,761 Bytes/Second
Integrity Errors found = 0

End of test.
------------------------------------------
I cleared the traffic on the pix before I started and here's a snapshot of "show traffic" on the pix right after the "Testing Save File Speed:"

outside:
received (in 55.520 secs):
2300 packets 217311 bytes
41 pkts/sec 3914 bytes/sec
transmitted (in 55.520 secs):
2919 packets 3616096 bytes
52 pkts/sec 65131 bytes/sec
inside:
received (in 55.530 secs):
16382 packets 22160380 bytes
295 pkts/sec 399070 bytes/sec
transmitted (in 55.530 secs):
1977 packets 212732 bytes
35 pkts/sec 3830 bytes/sec
dmz:
received (in 55.530 secs):
4671 packets 3826825 bytes
84 pkts/sec 68914 bytes/sec
transmitted (in 55.530 secs):
18364 packets 22339466 bytes
330 pkts/sec 402295 bytes/sec

-------------------------------------------
Here's a snapshot right after the "Testing Read File Speed and Integrity:"

outside:
received (in 107.000 secs):
4692 packets 456498 bytes
43 pkts/sec 4266 bytes/sec
transmitted (in 107.000 secs):
5803 packets 7086414 bytes
54 pkts/sec 66228 bytes/sec
inside:
received (in 107.000 secs):
32743 packets 24434873 bytes
306 pkts/sec 228363 bytes/sec
transmitted (in 107.000 secs):
22866 packets 22678992 bytes
213 pkts/sec 211953 bytes/sec
dmz:
received (in 107.000 secs):
28255 packets 29770203 bytes
264 pkts/sec 278226 bytes/sec
transmitted (in 107.000 secs):
36823 packets 24818437 bytes
344 pkts/sec 231948 bytes/sec

Ok if I calculated this correctly:
Calculated Save Speed :
399,701 Bytes/Second = 3.1976 Mbps
Calculated Read Speed :
436,761 Bytes/Second = 3.494 Mbps

Does anybody know if this is normal performance? The DMZ and Inside interface cards are 10/100 and are set to 100full. I'm asking because we are seeing some slow performance when our web box on the DMZ asks for data from our DB box on the Inside segment.

Any help that anybody can give will be highly appreciated.
Thanks,
Chris

 

[yizhar]

HI.

> I'm using the Testfile
Now I'm famous...
To get more accurate info it is recommended to also use other tools, like TTCP which comes on the WINXP-PRO setup CDROM in the SUPPORT folder, and other.

> 399,701 Bytes/Second
Yes - this means poor performance.
I've seen similar values with a bad switch.

> The DMZ and Inside interface cards are 10/100 and are set to 100full
Did you also check the switch configuration? and the other hosts?
Try with "auto". What do you get?
Try with "10baseT". What do you get?

What is your pix OS version?
Do you have PDM on the pix? You can use its monitoring graphs.

Take a look here:

http://www.cisco.com/warp/public/tech_tips/index/hardware/security/500/fn.html

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[Littlejohn2003]

Yizhar,
Still looking for the TTCP. Unless I just totally missed it.

Yes I changed the interfaces to Auto and same result.

I'm running IOS 6.1 and PDM 1.1. Yeah I know it's old. We just got a CCO today and believe me, I'm gonna use the HECK out of it tomorrow.

First thing I need to do is get the IOS and PDM upgraded so I can get the monitoring graphs. I gathered that from a handful of other posts from ya.

As for the possible bad switch, I hope that's not it. However, that's where I'm putting my money right now. If it is, then I'm gonna get chewed for not properly researching my hardware before purchase. I was talking to a consultant and they were kind of puzzled that I wasn't using a managed switch for the segments. They said that it's best to use a managed switch for those segments. Oh well, Yizhar, your utility programs rock, thanks for your help.

 

[yizhar]

HI.

> Still looking for the TTCP. Unless I just totally missed it
It is located on any WINXPPRO setup CDROM, here:
\VALUEADD\MSFT\NET\TOOLS
Or here:

http://teachers.sivan.co.il/yizhar/files/Net-Util/TTCP.EXE

Bye


Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[pabica]

IMHO..

It is difficult some times to determine what is "poor performance".. individual point tests are sometimes ineffective and can lead to incorrect conclusions... they test the system at one point in time and do not necessarily give the overall picture through the whole day...

I would suggest that you add snmp capability to your PIX (and all your routers) and watch the traffic flow throughout the day, week, month and year..

MRTG is a great product for this... I suggest that you monitor the inside and DMZ interfaces.. and your CPU utilization.. you end up with pretty graphs that even the CIO/CEO can understand... and you get a better picture of what is happening on your network...

also...
(if your PIX is not overloaded currently) start syslogging at the most detailed level to an appropriate syslog server and then write some PERL scripts to parse the log file.

I have routinely done this and discovered that the performance issues were not really there... or that a user had downloaded a piece of malware and my customer was actually part of a DDoS against an IRC server... or there is a large amount of misconfiguration going on... or... or..

(note that it is very important to appropriately protect your SNMP/syslog configuration with ACLs and SNMP community strings... and make sure that your syslog server is a very protected box)...

Thanks
Bill..

Bill Farnsworth