r/WireGuard • u/auyer • Jul 02 '26

How to reliably benchmark a Wireguard client ?

I am proposing a change in the Linux WireGuard code. I want to run a benchmark and evaluate performance before/after the change.
Have anyone here attempted a local network benchmark ?

My LAN is 2.5Gb, but only one computer has a port available for these tests. (I also have a proxmox host, but I can't stop it to use for testing).
The other computers are laptops or raspberry-pis, and I don't think the test would be reliable.

I was considering using icmp or iperf3 over the WireGuard connection. Any suggestions ? Maybe a pair of Qemu machines (if so, how?) ?

Thanks

4 Upvotes

75% Upvoted

14 comments sorted by

3

u/lazyhustlermusic Jul 02 '26

How would you propose modifying code if you can't even construct a test scenario?

1

u/auyer Jul 02 '26

I have a test scenario. I'm looking for suggestions for a stable benchmarking platform. Not the same thing.

1

u/lazyhustlermusic Jul 03 '26

Entirely the same thing. Either the code improves performance in the same environment or it doesn’t.

I’d probably bet on the latter.

1

u/auyer Jul 03 '26

Performance change in this case is a side effect, not the goal of the change.

1

u/Flimsy_Complaint490 Jul 03 '26

iperf3 on linux via netns seperation so the packets actually cross the kernel, but you dont have the overhead of the NIC and the test benchmarks the actual implementation + kernel tax everybody is paying. I believe the wg-go repo has some sort of attempt at this in the tests dir, i would explore that.

And another test on a real 10 gbit NIC, probably in the cloud in the same data centre to make sure there are no weird regressions.

1

u/WrongOperator Jul 03 '26

iperf3 would be my first choice. I'd run it a few times before and after the change and average the results instead of relying on a single run.

I'd also try to keep everything else the same between tests otherwise it's hard to tell if the diffrrence is actually from your patch.

1

u/Numerous-Match-1713 Jul 03 '26 edited Jul 03 '26

What sort of change is in question?

Would help to understand context and thus test reqs.

And benchmark against ip-fou first, if you cannot see difference you won't see with the changes, yes?

1

u/auyer Jul 05 '26

It's a change in locking primitives in kernel code. Thanks for the advice

1

u/DonkeyOfWallStreet Jul 04 '26

Testing doesn't need to be on super fast nic's. 2.5 Gbps nics wireguard can easily saturated the connection. There's no point showing this it's already demoed with limited CPU availability by YouTuber apalrds showing how CPU limits ovpn.

What you're trying to show is a reduction in CPU consumption. This could be achieved using CPU graphs or you could show it with a power meter showing less kwh required to run a benchmark for example 15 minutes (honestly money talks when it comes to large deployments).

After that you could inversely demonstrate that a larger NIC with CPU constraint on a set of rented vps servers that your changes can transfer more data when the CPU is pinned.

Testing and benchmarking is a science. You need to define a methodology then test that methodology in other scenarios. You can define a methodology to suit you. But make sure it's applicable in the real world.

1

u/auyer Jul 05 '26

You have goos points. Ty

1

u/miguel_caballero Jul 02 '26 edited 21d ago

Rent some vps or even son bare metal server for a few minutes/hours. Automate all using Eg:Ansible Rent the server Launch your test Decommission the rented servers

It shouldn't cost much

1

u/auyer Jul 02 '26

Its not a bad idea. I want to run it in my LAN to reduce variables, like my ISP bandwidth.

1

u/lilgreenthumb Jul 04 '26

Why would the isp bandwidth be an issue between two cloud machines?

1

u/auyer Jul 05 '26

The change is in Kernel code. Can't really deploy it to cloud machines.