Questions about forwarding mode

[dotSlashLu]

Hi developers. I have some experience with traditional LVS technology but just started to learn about this library, so please bear with me if my questions are not on the right track.

From the documentation I learned katran's forwarding mode is a bit like LVS' TUN mode, which needs L4 machines to wrap packets to IPIP protocol and requires the L7 have public network reachability. Will tunneling be a huge computational overhead for the L4 machines?

I think in most of deployment scenarios, L7 and L4 are just in the same local network and doesn't need IPIP to work. Why not support something like LVS's

• DR: L4 -direct routing-> L7 -> Client. Like TUN, but requires L4 and L7 to be L2 reachable and doesn't require tunneling. Or
• FullNAT: L4 -SNAT-> L7 -> L4 -DNAT-> Client. Doesn't require L2 reachability but packets needs to be returned to L4 to reach client

mode?

What is the design considerations of using tunnel? Thanks.

[yangchi]

• @udippant

[udippant]

Will tunneling be a huge computational overhead for the L4 machines?

I do not have any numbers to share here. But if you consider just the overhead of tunneling on the L4 machine, it is not that much (e.g. https://github.com/facebookincubator/katran/blob/master/katran/lib/bpf/pckt_encap.h#L41 - bpf_xdp_adjust_head, couple of memcpy and updates to write the additional header).

For #1 - with this you'll need to rely on mechanism such as ARP for routing to the servers, which has its own disadvantages. Tunneling simplifies this overall setup since it provides the L4 layer great control for routing of incoming packets to the servers.

For #2 - this adds another hop to L4 in the response path, which regresses the performance in several ways.

You can read more about the design considerations for Katran at https://engineering.fb.com/open-source/open-sourcing-katran-a-scalable-network-load-balancer/

[dotSlashLu]

Thanks udippant, the blog post answers a lot of my questions, including choosing XDP over DPDK. Still I think FullNAT is the best fit of our scenario. This library is a great base, I'll try to add FullNAT ability to it.

[tehnerd]

@dotSlashLu you will loose all the benefits of DSR with full nat. Frankly speaking I think if you need such feature - go with ipvs as it is already supports it. There is no need for xdp performance. As most likely you are going to be limited by interface capacity (as l4 would see both ingress and egress trqffic)