Development discussion of WireGuard
 help / color / mirror / Atom feed
From: David Bell <>
Subject: Improving Wireguard Throughput
Date: Mon, 17 Oct 2022 17:32:21 -0700	[thread overview]
Message-ID: <> (raw)

Hey all,

I'm investigating Wireguard as an alternative to mTLS in our
infrastructure and I'm trying to understand what's achievable in terms
of throughput and incremental cpu overhead, though at the moment I'm
focused on throughput.

We run 48 core machines with 25gbit NICs using the 5.10.113 kernel.
Benchmarking unencrypted traffic between hosts in the same dc achieves
line rate, and initially Wireguard was hitting ~2gbit. However, After
bumping up Wireguard's default MTU to 8920 I'm able to get to ~12gbit
throughput consistently over repeated benchmarks.

At this point I'm at a bit of a loss where to look for increasing
throughput. Independent results seem to be sparse for this kind of
workload, but looking at cilium's benchmark they were able to get
around 17.5gbit[0] with the following setup[1]. One thing I'm
wondering (probably incorrectly?) is whether we're being impacted by
Wireguard's lack of cpu affinity. Our NIC has 8 queues which are bound
to explicit cores, and my understanding with Wireguard is that
encrypt/decrypt handling is going to get splayed across all 48.


                 reply	other threads:[~2022-10-24 14:54 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='' \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).