On Fri, 16 Aug 2013 13:31:49 +0200 Herbert Poetzl <herbert@13thfloor.at> wrote: > Okay, what kernel/patch/util-vserver version? # vserver-info Versions: Kernel: 3.9.5-vs2.3.6.5 VS-API: 0x00020308 VCI: 0x0000000013003f11 util-vserver: 0.30.216-pre3025; Nov 15 2012, 15:10:33 Features: CC: x86_64-pc-linux-gnu-gcc, x86_64-pc-linux-gnu-gcc (Gentoo 4.5.4 p1.0, pie-0.4.7) 4.5.4 CPPFLAGS: '' CFLAGS: '-march=native -std=c99 -Wall -pedantic -W -funit-at-a-time' build/host: x86_64-pc-linux-gnu/x86_64-pc-linux-gnu Use dietlibc: yes Build C++ programs: Build C99 programs: yes Available APIs: v13,net,v21,v22,v23,netv2 ext2fs Source: e2fsprogs syscall(2) invocation: alternative vserver(2) syscall#: 236/glibc crypto api: beecrypt python bindings: no use library versioning: yes Paths: prefix: /usr sysconf-Directory: /etc cfg-Directory: /etc/vservers initrd-Directory: $(sysconfdir)/init.d pkgstate-Directory: /var/run/vservers vserver-Rootdir: /vservers > > Are network related interrupts routed to the host > only CPU (0 in your case)? Sorry, I don't know how to do that. net1 is my Internet interface: # grep net1 /etc/conf.d/net config_net1="null" link_ppp0="net1" net1 uses interrupt 65: # cat /proc/interrupts | head -n 1 && cat /proc/interrupts | grep net1 CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 CPU6 CPU7 65: 38806 36024 38935 35519 38778 35409 39808 35463 PCI-MSI-edge net1 On my eight core machine I thought that something like the following would force CPU 0 to use interrupt 65: # echo 01 > /proc/irq/65/smp_affinity But maybe it doesn't because the interrupt still seems to be shared: # cat /proc/interrupts | head -n 1 && cat /proc/interrupts | grep net1 CPU0 CPU1 CPU2 CPU3 CPU4 CPU5 CPU6 CPU7 65: 38834 36260 38956 35737 38810 35617 39837 35678 PCI-MSI-edge net1 > > Does it happen on a specific guest? Packets are dropped when any guest is under load. > If so, which guest load triggers it? > > > How do I prevent my guest-related packet drops? > > Ingress filtering works by dropping packets, so > how do you know that the packets are not dropped > because the limit was reached? I don't know. But what I do know is that, with only pings across the interface the host maxing-out all eight cores does not cause packet loss when ingress is filtered with intermediate functional block. Any guest using as few as one core does cause packet loss. Thank you very much for your reply. Regards Fog_Watch.