Recommendations
in this section refer to NT 4.0 and/or 2000 versions of the
Windows OS. Some of the tunables are common to both OS versions,
in these cases no additional comments are made. If a particular
tuning technique is only relevant to one of the OS versions,
this fact is specifically mentioned in the guide.
1.
Set the Windows NT memory strategy to "Maximize Throughput
for Network Applications".
NT:
By default it is set to "Maximize Throughput for File
Sharing" which allocates all available to NT memory to
file cache. Set under ControlPanel -> Network -> Server.
2.
Disable all unneeded services and drivers
The services
that are installed and started by default in Windows NT 4.0
and especially in Windows 2000 are too numerous to list. It
is a good practice to go over all of them and disable everything
that is not directly relevant to your VPN-1 gateway installation.
Examples are DHCP client/server, Remote Registry Service,
Distributed File System Service and others. The same concerns
all the drivers that are not productively used in your installation,
examples are Parallel, ParPort, etc.
3.
Disable performance boost for foreground applications
NT:
Set in ControlPanel -> System -> Performance. Move the
Application Performance slider to None.
Gives the security servers the maximum amount of system resources.
2000: Set in ControlPanel -> System -> Advanced
-> Performance Options. Give priority to Background Services
4.
Pagefile optimization
Create
a fixed size (do not allow it to grow dynamically) page file
of at least 2 times the amount of RAM available on a another
(preferably dedicated) disk drive.
5.
Tuning TCP/IP registry values to improve network performance
Parameters
that affect the IP forwarding performance:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\ForwardBufferMemory
= 296960
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxForwardBufferMemory
= 296960
REG_DWORD, multiple of 256, default 74240. Buffer the IP allocates
to store packet data in the router queue. The default value
is enough for 50 1480-byte packets.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\NumForwardPackets
= 200
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxNumForwardPackets
= 200
REG_DWORD, default 50. Number of IP headers allocated for
router queue. Should be at least as large as ForwardBufferMemory
/ IP data size of the network.
Increasing
these four parameters can have significant positive effect
on throughput especially with 'slow' policies. Also good for
FloodGate-1 tuning.
Other
TCP/IP stack parameters:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\TcpWindowSize
REG_DWORD, default 8760 for Ethernet. Larger TCP receive
window size will improve performance over high-speed networks.
For highest efficiency should be even multiple of TCP Maximum
Segment Size (MSS).
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxFreeTcbs
= 0xFA0
REG_DWORD, default 2000, timewait table size
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxHashTableSize
= 0x400
REG_DWORD, default 512, TCB hash table size
Increase
the number of ephemeral TCP user ports available to applications
- prevents the SS from running out of ports:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort
= 65535
REG_DWORD, default 5000
6.
On SMP systems, tune the Network Interface Card interrupt
affinity for maximal performance
NT:
Change the ProcessorAffinityMask:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NDIS\Parameters\ProcessorAffinityMask
= 0
This improves the CPUs servicing of interrupts and DPCs generated
by the network interface card(s). Also unties the NIC from
a specific CPU.
W2000:
Use the IntFiltr (Interrupt Affinity Filter) utility from
Microsoft (available for free download) to assign interrupts
from different NICs to different CPUs:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/tools/affinity/intfiltr.zip
7.
Tuning the specific vendor's NIC parameters for maximal performance
Tuning
the relevant NIC parameters can have significant performance
effect.
Although
the NIC Setup Interface and the NIC tunable parameters (properties)
are proprietary to the specific network adapter most of the
basic tunable parameters may be common to other brands/models.
Below
are recommended settings for some commonly used Fast Ethernet
and Gigabit NICs:
7.1
Intel PRO/1000 Family of Gigabit Ethernet network adapters
in the
registry, under the following branch:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\E1000n\Parameters\
(x - number of the Intel PRO/1000 interface
installed in the system)
set the
following registry values:
NumberOfReceiveBuffers
= 768
NumberOfCoalesceBuffers = 512
NumberOfTransmitDescriptors = 512
NumberOfReceiveDescriptors = 256
The actual
registry value names may differ slightly depending on the
PRO/1000 driver version (NumberOfTransmitDescriptors vs. NumTxDescriptors)
but usually the names are close enough to be easily figured
out. Most of the same values can also be set via the Intel
PROSet utility under ControlPanel->Network->Adapter
Properties->Advanced.
7.2
Alteon ACENic Gigabit Ethernet network adapter
TransmitControlBlocks
= 64
RecvCoalMax = 20
RecvCoalTicks = 1000
SendCoalMax = 20
SendCoalTicks = 1000
7.2
Intel PRO/100+ PCI Fast Ethernet network adapter
Under
ControlPanel->Network->Adapter Properties->Advanced:
Adaptive
Performance Tuning set to Maximal Adapter Bandwidth
Receive Buffers = 256
Transmit Control Blocks = 64
Coalesce Buffers = 16
The actual
performance effect of these tunables depends on many factors
such as traffic type, packet sizes, etc, so it is advised,
if such opportunity exists, to experiment with the values
for the maximal performance gain. Otherwise use values listed
here.
|