This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Slow web browsing when streaming Netflix

Just relatively recently I've started noticing poor performance when watching Netflix on my TV. The movie would start playing, and then all of the sudden I'd get an error message that the "content requested can't be played at this time, try again later", restarting the movie works fine, but same message appears after some time. The quality of the videos seem to be also suffering, although it would play in 1080p, you could see video encoding artifacts from time to time (e.g. color blocks, etc.)

Today I noticed that browsing the web, while Netflix streaming on TV, is also lagging. Most of the sites would load, but with big lag, occasionally a site wouldn't load at all. Accessing WebAdmin is also laggy, even SSH session suffer a lagged response (when using TOP or IFTOP commands for example). As soon as I stop the playback, everything comes back to normal operation, web, SSH, WebAdmin, etc.

I also have a BD player with Netflix service (Oppo) and it has the same effect (causes lag). Streaming other sites (like YouTube) has no problem at all. So, only Netflix seems to be the issue.

I'm on the latest UTM firmware, TV and BD player are added to Web Protection exception for hosts, both are hardwired to my Cisco SG200-26 switch (not a WiFi AP problem). When looking at TOP command the CPU doesn't go above 2-3% when streaming. Nothing in the logs either (nothing that I could see at least).

When browsing internal sites, on local network, no problems. Only content that's accessed through the UTM gateway has issues when streaming. So, I don't think it's an issue with the switch.

Has anyone seen anything like this before?

This thread was automatically locked due to age.

0 William Warren over 9 years ago

I do not think so your best bet is to replace the nics with addin ones then you only have to mess with it once.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to dmitripr

Ok, looks like it's the driver bug after all. I came across this thread: https://ubb.sophos.com/closed-forums-read-only/utm-9-betas/utm-9-3-beta/54786-9-302-2-bug-adapter-e1000e-hangs-reset.html

My question now is: is there a way to make this change survive a reboot?

Follow Mario's post https://ubb.sophos.com/closed-forums-read-only/utm-9-betas/utm-9-3-beta/54786-9-302-2-bug-adapter-e1000e-hangs-reset.html#post280668

I haven't used astaro outside a vm since v8 so don't know if the procedure works below. You can try and let us know[;)]

Looks like they are already disabling tso on some intel NICs. The procedure is outlined in the post below for better linking.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 9 years ago

Intel has not presented a fix for this issue with those chipsets with the iseries release and i am sure Intel is not going to. With the new appliances not using this chipset i doubt Sophos is going to worry about it as a long term fix either.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to Billybob
How to add udev rule:

Login your console/ssh as root and type
cat /etc/udev/rules.d/20-nic.rules
and see if your NIC is already listed there. If it is already listed then you don't have to do anything. Sophos already has the tso disabled for your NIC.

If its not listed there,
Check the vendor/device ID of your currently used Intel NIC,
lspci -nn | grep -i ethernet
and you will get output similar to
01:00.0 Ethernet controller [0200]: Intel 82579LM Gigabit Network Card [8086:1502]

All you are interested in is vendor ID which is 8086 for intel corporation
and device ID which is 1502 for 82579LM cards.

then create a new file
vi /etc/udev/rules.d/21-my-nic.rules

press "i" on keyboard to insert text and paste the following line
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x1502", RUN+="/lib/udev/nic-disable-tso"

If you have multiple Intel NICs with different device IDs then add another line for your second or third NIC. Then press esc on keyboard and type
:wq
and press ENTER to save the file.

Reboot and test. Please let us know if this works for you. As noted in Mario's reply, this will survive a reboot and updates unless udev is updated.

Hope this helps
Bill
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to William Warren

Intel has not presented a fix for this issue with those chipsets with the iseries release and i am sure Intel is not going to. With the new appliances not using this chipset i doubt Sophos is going to worry about it as a long term fix either.

Intel is still releasing drivers for this card https://downloadcenter.intel.com/product/32210/Intel-82574-Gigabit-Ethernet-Controller

TSO/LRO errors rear their ugly heads once in a while but can be easily disabled. As you have noted previously, the bug is not present in windows so if disabling tso fixes the problem, then it is not a big deal specially if someone already has the hardware.

I agree that if you have a choice then stay away from NICs that have known e1000/e1000e linux drivers issues.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 9 years ago in reply to Billybob

Intel is still releasing drivers for this card https://downloadcenter.intel.com/product/32210/Intel-82574-Gigabit-Ethernet-Controller

TSO/LRO errors rear their ugly heads once in a while but can be easily disabled. As you have noted previously, the bug is not present in windows so if disabling tso fixes the problem, then it is not a big deal specially if someone already has the hardware.

I agree that if you have a choice then stay away from NICs that have known e1000/e1000e linux drivers issues.

the issue is not fixed by a driver update though. You have to change the firmware of the card as well. Intel has not released a fix for this bug yet...at least not according to my research.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 widdde over 9 years ago

I also have 82574L in my computer running Sophos UTM.
It is a completely new built computer so it is sad to see that the
Intel nice has problems..
I have 2 82574L intel nics in the computer and 1 82572EL (an older card)
and a realtek built-in card on the motherboard (not used).

Does the 82572EL-card also has this issue or can I keep that card and throw the other ones out? And buy a better card.. Was the Intel I210 a better card and is it proven that it does not has any of the bugs that the 82574L has?

I am not very interested in buying another intel card, because their ignorance regarding the bugs in the 82574-cards.. I thought they were reliable in the linux world, it seem I was wrong..
What other brands (as cheap as possible, due to I have already spent money on crappy intel cards.....)

EDIT: I have not understood if the problems is fixable in Sophos UTM? Can I disable something and the problem will go away or is it just crappy hardware that isn't fixable without an intel firmware upgrade (that is non existent..?)
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to widdde
I have 2 82574L intel nics in the computer
Alot of those cards should work fine without any input from you. Are you currently having problems with your NICs? Those cards already have the tso workaround applied in newer builds of sophos.
From /etc/udev/rules.d/20-nic.rule in v9.315
# e1000e: disable TSO for Intel 82574L (errata 17, #30345)
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10d3", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10f6", RUN+="/lib/udev/nic-disable-tso"

Does the 82572EL-card also has this issue or can I keep that card and throw the other ones out?

82572EL is also included
# e1000e: disable TSO for 82572EI (errata 7, #30669)
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107d", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107e", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107f", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10b9", RUN+="/lib/udev/nic-disable-tso"

Check if your card is already has the workaround applied from my post above https://www.astaro.org/gateway-products/general-discussion/59238-slow-web-browsing-when-streaming-netflix-3.html#post308974 and if the workaround is not there, you can apply it by following the steps in my post.

Turning off TSO shouldn't be a big deal but if your processor load goes up for very high I/Os, you may start looking at other NICs.
Cancel
Vote Up 0 Vote Down

Cancel
0 widdde over 9 years ago in reply to Billybob
Alot of those cards should work fine without any input from you. Are you currently having problems with your NICs? Those cards already have the tso workaround applied in newer builds of sophos.
From /etc/udev/rules.d/20-nic.rule in v9.315
# e1000e: disable TSO for Intel 82574L (errata 17, #30345)
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10d3", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10f6", RUN+="/lib/udev/nic-disable-tso"

82572EL is also included
# e1000e: disable TSO for 82572EI (errata 7, #30669)
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107d", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107e", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x107f", RUN+="/lib/udev/nic-disable-tso"
SUBSYSTEM=="net", ACTION=="add", ATTRS{vendor}=="0x8086", ATTRS{device}=="0x10b9", RUN+="/lib/udev/nic-disable-tso"

Check if your card is already has the workaround applied from my post above https://www.astaro.org/gateway-products/general-discussion/59238-slow-web-browsing-when-streaming-netflix-3.html#post308974 and if the workaround is not there, you can apply it by following the steps in my post.

Turning off TSO shouldn't be a big deal but if your processor load goes up for very high I/Os, you may start looking at other NICs.

How do I get my vendor and device-id? Checked on my cards and can't find such information on the cards?
Can I see it with a command when logged in via ssh or how can I get this information?

EDIT:
Checked it with lspci -nn via ssh on the sophos machine. Got this information:

00:1c.0 PCI bridge [0604]: Intel Corporation ValleyView PCI Express Root Port [8086:0f48] (rev 0e)
00:1c.1 PCI bridge [0604]: Intel Corporation ValleyView PCI Express Root Port [8086:0f4a] (rev 0e)
00:1c.2 PCI bridge [0604]: Intel Corporation ValleyView PCI Express Root Port [8086:0f4c] (rev 0e)
00:1c.3 PCI bridge [0604]: Intel Corporation ValleyView PCI Express Root Port [8086:0f4e] (rev 0e)
00:1f.0 ISA bridge [0601]: Intel Corporation ValleyView Power Control Unit [8086:0f1c] (rev 0e)
00:1f.3 SMBus [0c05]: Intel Corporation ValleyView SMBus Controller [8086:0f12] (rev 0e)
01:00.0 Ethernet controller [0200]: Intel Corporation 82574L Gigabit Network Connection [8086:10d3]
02:00.0 Ethernet controller [0200]: Intel Corporation 82572EI Gigabit Ethernet Controller (Copper) [8086:10b9] (rev 06)
03:00.0 Ethernet controller [0200]: Intel Corporation 82574L Gigabit Network Connection [8086:10d3]
04:00.0 Ethernet controller [0200]: Realtek Semiconductor Co., Ltd. RTL8111/8168 PCI Express Gigabit Ethernet controller [10ec:816

EDIT2: Looks like both my cards are in the list, as said. Thanks BillyBob for the information!

EDIT3: BillyBob, no I have no issues with my sophos box, but I have only had it for 2 days so I haven't done any deep inspection of it yet. But when I red about the 82574L controller and the issues I wanted to know if I can get any problems with them before it is fully integrated in my network..
Cancel
Vote Up 0 Vote Down

Cancel
0 Billybob over 9 years ago in reply to widdde

Thanks widdde for your feedback. I have edited my original post with the addition of lspci command.

I don't think you will have any problems but keep us posted with your progress[;)]
Cancel
Vote Up 0 Vote Down

Cancel