Freebsd softouter?

Question

FreeBSD

I have an Intel® Pentium® D CPU 3.00GHz server on a server motherboard. On board network card Intel Corporation 82573V, Intel Corporation 82541GI. Axis freebsd 8.2
Inlet 41 vlan.
Packet stats

input (em0) output<br/>
 packets errs idrops bytes packets errs bytes colls<br/>
 18324 0 0 14542391 19034 0 12394248 0

CPU load

last pid: 51647; load averages: 2.31, 2.52, 2.64 up 0+07:24:25 23:05:33<br/>
140 processes: 6 running, 118 sleeping, 16 waiting<br/>
CPU 0: 0.0% user, 0.0% nice, 100% system, 0.0% interrupt, 0.0% idle<br/>
CPU 1: 0.0% user, 0.0% nice, 100% system, 0.0% interrupt, 0.0% idle<br/>
Mem: 92M Active, 14M Inact, 111M Wired, 192K Cache, 22M Buf, 1779M Free<br/>
Swap: 2048M Total, 2048M Free<br/>
<br/>
PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND<br/>
 13 root 76 - 0K 16K sleep 0 167:03 49.66% {ng_queue0}<br/>
 13 root 76 - 0K 16K RUN 1 165:46 37.21% {ng_queue1}<br/>
 0 root -68 0 0K 72K - 1 145:16 29.83% {dummynet}<br/>
 0 root -68 0 0K 72K - 0 150:11 26.81% {em1 taskq}<br/>
 0 root -68 0 0K 72K - 1 96:55 14.94% {em0 taskq}<br/>
 11 root 171 ki31 0K 16K RUN 0 33:00 14.75% {idle: cpu0}<br/>
 6707 root 52 0 3292K 960K RUN 0 37:02 10.55% meoip<br/>
 11 root 171 ki31 0K 16K RUN 1 27:15 5.22% {idle: cpu1}<br/>
51310 root 44 -15 39056K 32592K select 0 0:06 1.42% {ipcad}<br/>
 22 root 45 - 0K 8K flowcl 1 4:20 1.12% flowcleaner<br/>
51310 root 44 -15 39056K 32592K select 0 0:03 0.44% {ipcad}

meoip - a thing that holds an easy tunnel to the Mikrotik router - a temporary solution.
Kernel
config sysctl.conf

[[email protected] rc.d]$ ipfw list|wc<br/>
 189 1822 22843<br/>
[[email protected] rc.d]$ ipfw table 1 list | wc<br/>
 534 1068 10539<br/>
[[email protected] rc.d]$ ipfw table 2 list | wc <br/>
 151 302 2529

The router performs the standard functions nat(ng_nat)+ipfw+netflow(ipcad)+shaping
What else can you squeeze out of the system?

Answer 1

You already have 100 + 100 on the cores, what else do you want from her? :)
Optimize the rules, 189 rules in the studio. Try changing ng_nat to kernel_nat, maybe it will be faster, although it is not known.
Disable inflight
Play around with isr values
​​Another thing to keep it local:
net.inet.tcp.fast_finwait2_recycle=1
net.inet.tcp.maxtcptw=5120
net.inet.tcp.nolocaltimewait=1

Answer 2

I want the load to be less and to squeeze something else out =) by the way, one core is a consequence of hyperthreading. maybe disable hyperthreading? does it make any sense at all?
net.inet.tcp.inflight.enable: 0 - seems to be disabled.
And how to twist isr? there is something all readonly ...
Here are the rules www.mafet.ru/ipfw