Hi There,
I recently suffered a serious hardware failure on one of my firewalls, (motherboard died), this machine was originally a redhat 9 box, on an Athlon 2200 with 512Megs RAM, this machine was doing the following jobs for a small network at a relatives house:
Firewall (IPTABLES) Transparent proxy (squid) Sendmail smarthost IMAP mail server SAMBA file server IPSEC tunnel to my home.
The only machines I had to replace it with were an Intel SC5000 chassis with twin PIII 1GHz CPUs on SCSI RAID (1 Gig RAM) and a compaq PII 450 (512Megs) software RAID on IDE 40Gig drives.
So I installed Centos 4.2 on both, split the IMAP and SAMBA onto the SC5000 and put the firewall, Squid and sendmail smarthost on the Compaq. The system is connected to the net via a 2Meg Line.
While each of these machines easily copes with the jobs they have to do, I have noticed (or rather my relative noticed and I agreed) that web browsing now has a high latency. i.e. you go to a new web page, there is a substantial pause, before the page starts to load (substantial a few seconds, whereas previously it was instant). DNS is all ok and working fine, there are no delays there. The DSL line shows very little latency from the net and outgoing from the lan.
I note that squid uses a fair amout of CPU on the PII450 from time to time, but can't seem to get a handle on what is causing the delay. The only thing I can think of is that the PII450 running squid is just slow compared to the old Athlon box and I am reaping the "benefits" of that. I do find that hard to believe though, since the box isn't running X or anthing else extra. I also notice that sometimes some downloads, particularly large ones just seem to grind to a halt after a few megs, and sometimes then carry on a bit later if left, right up to full speed of the line. During this slowdown, the latency of the line even with large pings is fine, so I am sure the connection is good.
Is Centos4.2 now so heavy that a PII450 is not enough for a transparent proxy and smarthost....
Any comments/ideas are welcome...
Pete