Subject: How to Benchmark SSL on Apache based servers?

From: Robert Lagana <[email-masked]>
Date: Thu, 26 Sep 2002 15:31:51 -0400

Hi,

Is it possible to benchmark the server load with mod_ssl enabled on Apache?

Is there particular software that can do this?

Thanks,
Rob

---

From: Josh Chamas <[email-masked]>
Date: Fri, 27 Sep 2002 10:28:22 -0700

> Is there particular software that can do this?

In perl, you could do this by scripting a quick benchmark
with LWP & Crypt::SSLeay libraries. ( LWP loads Crypt::SSLeay
on the backend for https URLs )

Here's a crude command that will set 2 web clients hitting
your SSL server at the same time:

]$ perl -MLWP::Simple -MBenchmark -e 'fork; timethis(25, sub { get(qq(https://localhost/)); }); wait;'
timethis 25: 11 wallclock secs ( 2.78 usr +  0.07 sys =  2.85 CPU) @  8.77/s (n=25)
timethis 25: 11 wallclock secs ( 3.03 usr +  0.07 sys =  3.10 CPU) @  8.06/s (n=25)

The timethis() stats aren't really relevant in this case, but
it gave 50 requests done in 11 seconds.  Obviously, since the
client was running on the same machine as the server, the servers
real performance would be quite different by itself.

Regards,

Josh
________________________________________________________________
Josh Chamas, Founder                   phone:925-552-0128
Chamas Enterprises Inc.                http://www.chamas.com
NodeWorks Link Checking                http://www.nodeworks.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Geoff Thorpe <[email-masked]>
Date: Fri, 27 Sep 2002 15:33:12 -0400 (EDT)

Hey there,

> real performance would be quite different by itself.

heh :-)

There is another solution out there (shameless plug);
   http://www.geoffthorpe.net/crypto/swamp/

This will also let you mess around with combinations of session resume
(attempts) from the client requests - something important if you're trying
to simulate more or less the profile of traffic you expect a server to be
hit with in real life. Hitting it with nothing but a barrage of SSL/TLS
session negotiations is doing little more than determining what it would
take to DoS your server, which is perhaps not the only information you're
looking for.

BTW: The README may be useful even if you don't want to use swamp - it's
online at;
   http://www.geoffthorpe.net/crypto/swamp/swamp-1.1.0/README

Cheers,
Geoff

-- 
Geoff Thorpe
[email-masked]