OpenVPN on ARM, what are known bottlenecks apart from Crypto

totaluser

Hello everybody,
I use OpenVPN quite often and I am very happy with the service it provides
I was running it on RaspberryPI (ARMv6) and after overclock to 900MHz I was able to push 15Mbps through the tunnel and CPU was bottleneck

so I bough Odroid-U3 which is QuadCore ARMv7 (Exynos 4412) @1.7GHz and 2GB RAM and was hoping to saturate my home connection, which is 70/70Mbps fiber

so I compiled OpenVPN 2.3.4 on Odroid-U3 and deployed my configs

 port 1194
 proto udp
 dev tun

 tun-ipv6

 ca /etc/openvpn/ca.crt
 cert /etc/openvpn/OpenVPN-Odroid_U3.crt
 key /etc/openvpn/OpenVPN-Odroid_U3.key
 dh /etc/openvpn/dh4096.pem
 server XXX.XXX.XXX 255.255.255.224
 cipher AES-256-CBC
 persist-key
 persist-tun
 status /var/log/openvpn/openvpn-status.log
 log-append /var/log/openvpn/openvpn.log
 verb 3
 tun-mtu 1500
 mssfix 1440
 client-to-client

 server-ipv6 2A02:XXXX:XXXX:XXXX::XXXX/64
 push "route-ipv6 2A02:XXXX:XXXX:XXXX::/64"
 push "route-ipv6 2A02:XXXX:XXXX:XXXX::/64"
 route-ipv6 2A02:XXXX:XXXX:XXXX::/64
 push "route-ipv6 2000::/3"
 ifconfig-ipv6 2A02:XXXX:XXXX:XXXX::XXXX/64 2A02:XXXX:XXXX:XXXX::XXXX

 push "route XXX.XXX.XXX.XXX 255.255.255.0"
 push "dhcp-option DNS 8.8.8.8"
 push "dhcp-option DNS 208.67.220.220"

 push "route 0.0.0.0 128.0.0.0"
 push "route 128.0.0.0 128.0.0.0"

 remote-cert-tls client
 keepalive 5 30
 topology subnet
 daemon
 comp-lzo adaptive

everything worked, there was significant performance gain
I was able to push 35-36Mbps through the tunnel with AES-256-CBC encryption

It wasn't bad but I was expecting to get to somewhere in 50-60Mbps region for a single client

according to top command openvpn was utilizing a single core (since it is singlethreaded) ~60-70%
there seems to be plenty of processing power left on other cores and even a bit on the core openvpn is using

immediately I though that encryption process is the bottleneck so I used

cipher none
auth none

on both server and client and to my surprise I only achieved speeds greater by 1-2Mbps --> 37-38Mbps in total

from this I conclude that encryption is not the bottleneck in this case

on the other side I had Intel SU7300@1.3GHz (dualcore) and Intel Q6600@2.66GHz (quadcore) connected to 100Mbps+ university fiber and I was able to achieve speeds greater than 70Mbps of my home connection
my university and my ISP peer in the nearby building with 1Gbps connection so speed and latency (measure 1-2ms) is not the issue

reading many articles dealing with increasing openvpn throughput, namely this (https://community.openvpn.net/openvpn/wiki/Gigabit_Networks_Linux)

increasing tun-mtu and setting mssfix and fragment to 0 did not show any increase in throughput either

here is the output of my sysctl variables

odroid@odroidu2:~/Downloads/openvpn-2.3.4$ sudo sysctl -a
[sudo] password for odroid: 
fs.aio-max-nr = 65536
fs.aio-nr = 2661
fs.dentry-state = 44368 41289   45      0       0       0
fs.dir-notify-enable = 1
fs.epoll.max_user_watches = 265004
fs.file-max = 201889
fs.file-nr = 736        0       201889
fs.inode-nr = 32880     176
fs.inode-state = 32880  176     0       0       0       0       0
fs.inotify.max_queued_events = 16384
fs.inotify.max_user_instances = 128
fs.inotify.max_user_watches = 8192
fs.lease-break-time = 45
fs.leases-enable = 1
fs.nr_open = 1048576
fs.overflowgid = 65534
fs.overflowuid = 65534
fs.pipe-max-size = 1048576
fs.protected_hardlinks = 1
fs.protected_symlinks = 1
fs.suid_dumpable = 0
kernel.auto_msgmni = 1
kernel.blk_iopoll = 1
kernel.cad_pid = 1
kernel.cap_last_cap = 36
kernel.core_pattern = core
kernel.core_pipe_limit = 0
kernel.core_uses_pid = 0
kernel.ctrl-alt-del = 0
kernel.dmesg_restrict = 0
kernel.domainname = (none)
kernel.hostname = odroidu2
kernel.hotplug = 
kernel.hung_task_check_count = 32768
kernel.hung_task_panic = 0
kernel.hung_task_timeout_secs = 120
kernel.hung_task_warnings = 10
kernel.keys.gc_delay = 300
kernel.keys.maxbytes = 20000
kernel.keys.maxkeys = 200
kernel.keys.root_maxbytes = 20000
kernel.keys.root_maxkeys = 200
kernel.kptr_restrict = 0
kernel.max_lock_depth = 1024
kernel.modprobe = /sbin/modprobe
kernel.modules_disabled = 0
kernel.msgmax = 8192
kernel.msgmnb = 16384
kernel.msgmni = 1473
kernel.ngroups_max = 65536
kernel.osrelease = 3.8.13.3
kernel.ostype = Linux
kernel.overflowgid = 65534
kernel.overflowuid = 65534
kernel.panic = 0
kernel.panic_on_oops = 0
kernel.perf_event_max_sample_rate = 100000
kernel.perf_event_mlock_kb = 516
kernel.perf_event_paranoid = 1
kernel.pid_max = 32768
kernel.poweroff_cmd = /sbin/poweroff
kernel.print-fatal-signals = 0
kernel.printk = 7       4       1       7
kernel.printk_delay = 0
kernel.printk_ratelimit = 5
kernel.printk_ratelimit_burst = 10
kernel.pty.max = 4096
kernel.pty.nr = 1
kernel.pty.reserve = 1024
kernel.random.boot_id = 781de599-ae4b-4ba8-a7bd-51da66b7d794
kernel.random.entropy_avail = 140
kernel.random.poolsize = 4096
kernel.random.read_wakeup_threshold = 64
kernel.random.uuid = 0c8ab249-6409-4b92-baaa-15bd34c014bb
kernel.random.write_wakeup_threshold = 128
kernel.randomize_va_space = 1
kernel.real-root-dev = 0
kernel.sched_child_runs_first = 0
kernel.sched_domain.cpu0.domain0.busy_factor = 64
kernel.sched_domain.cpu0.domain0.busy_idx = 2
kernel.sched_domain.cpu0.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu0.domain0.flags = 559
kernel.sched_domain.cpu0.domain0.forkexec_idx = 0
kernel.sched_domain.cpu0.domain0.idle_idx = 0
kernel.sched_domain.cpu0.domain0.imbalance_pct = 125
kernel.sched_domain.cpu0.domain0.max_interval = 4
kernel.sched_domain.cpu0.domain0.min_interval = 1
kernel.sched_domain.cpu0.domain0.name = MC
kernel.sched_domain.cpu0.domain0.newidle_idx = 0
kernel.sched_domain.cpu0.domain0.wake_idx = 0
kernel.sched_domain.cpu1.domain0.busy_factor = 64
kernel.sched_domain.cpu1.domain0.busy_idx = 2
kernel.sched_domain.cpu1.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu1.domain0.flags = 559
kernel.sched_domain.cpu1.domain0.forkexec_idx = 0
kernel.sched_domain.cpu1.domain0.idle_idx = 0
kernel.sched_domain.cpu1.domain0.imbalance_pct = 125
kernel.sched_domain.cpu1.domain0.max_interval = 4
kernel.sched_domain.cpu1.domain0.min_interval = 1
kernel.sched_domain.cpu1.domain0.name = MC
kernel.sched_domain.cpu1.domain0.newidle_idx = 0
kernel.sched_domain.cpu1.domain0.wake_idx = 0
kernel.sched_domain.cpu2.domain0.busy_factor = 64
kernel.sched_domain.cpu2.domain0.busy_idx = 2
kernel.sched_domain.cpu2.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu2.domain0.flags = 559
kernel.sched_domain.cpu2.domain0.forkexec_idx = 0
kernel.sched_domain.cpu2.domain0.idle_idx = 0
kernel.sched_domain.cpu2.domain0.imbalance_pct = 125
kernel.sched_domain.cpu2.domain0.max_interval = 4
kernel.sched_domain.cpu2.domain0.min_interval = 1
kernel.sched_domain.cpu2.domain0.name = MC
kernel.sched_domain.cpu2.domain0.newidle_idx = 0
kernel.sched_domain.cpu2.domain0.wake_idx = 0
kernel.sched_domain.cpu3.domain0.busy_factor = 64
kernel.sched_domain.cpu3.domain0.busy_idx = 2
kernel.sched_domain.cpu3.domain0.cache_nice_tries = 1
kernel.sched_domain.cpu3.domain0.flags = 559
kernel.sched_domain.cpu3.domain0.forkexec_idx = 0
kernel.sched_domain.cpu3.domain0.idle_idx = 0
kernel.sched_domain.cpu3.domain0.imbalance_pct = 125
kernel.sched_domain.cpu3.domain0.max_interval = 4
kernel.sched_domain.cpu3.domain0.min_interval = 1
kernel.sched_domain.cpu3.domain0.name = MC
kernel.sched_domain.cpu3.domain0.newidle_idx = 0
kernel.sched_domain.cpu3.domain0.wake_idx = 0
kernel.sched_latency_ns = 18000000
kernel.sched_migration_cost_ns = 500000
kernel.sched_min_granularity_ns = 2250000
kernel.sched_nr_migrate = 32
kernel.sched_rt_period_us = 1000000
kernel.sched_rt_runtime_us = 950000
kernel.sched_shares_window_ns = 10000000
kernel.sched_time_avg_ms = 1000
kernel.sched_tunable_scaling = 1
kernel.sched_wakeup_granularity_ns = 3000000
kernel.sem = 250        32000   32      128
kernel.shm_rmid_forced = 0
kernel.shmall = 2097152
kernel.shmmax = 33554432
kernel.shmmni = 4096
kernel.sysrq = 1
kernel.tainted = 0
kernel.threads-max = 31551
kernel.timer_migration = 1
kernel.usermodehelper.bset = 4294967295 4294967295
kernel.usermodehelper.inheritable = 4294967295  4294967295
kernel.version = #1 SMP PREEMPT Sat Jun 22 00:52:21 BRT 2013
net.core.dev_weight = 64
net.core.message_burst = 10
net.core.message_cost = 5
net.core.netdev_budget = 300
net.core.netdev_max_backlog = 1000
net.core.netdev_tstamp_prequeue = 1
net.core.optmem_max = 10240
net.core.rmem_default = 163840
net.core.rmem_max = 163840
net.core.rps_sock_flow_entries = 0
net.core.somaxconn = 128
net.core.warnings = 1
net.core.wmem_default = 163840
net.core.wmem_max = 163840
net.core.xfrm_acq_expires = 30
net.core.xfrm_aevent_etime = 10
net.core.xfrm_aevent_rseqth = 2
net.core.xfrm_larval_drop = 1
net.ipv4.conf.all.accept_local = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.arp_accept = 0
net.ipv4.conf.all.arp_announce = 0
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.arp_ignore = 0
net.ipv4.conf.all.arp_notify = 0
net.ipv4.conf.all.bootp_relay = 0
net.ipv4.conf.all.disable_policy = 0
net.ipv4.conf.all.disable_xfrm = 0
net.ipv4.conf.all.force_igmp_version = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.medium_id = 0
net.ipv4.conf.all.promote_secondaries = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.proxy_arp_pvlan = 0
net.ipv4.conf.all.route_localnet = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.all.shared_media = 1
net.ipv4.conf.all.src_valid_mark = 0
net.ipv4.conf.all.tag = 0
net.ipv4.conf.default.accept_local = 0
net.ipv4.conf.default.accept_redirects = 1
net.ipv4.conf.default.accept_source_route = 1
net.ipv4.conf.default.arp_accept = 0
net.ipv4.conf.default.arp_announce = 0
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.arp_ignore = 0
net.ipv4.conf.default.arp_notify = 0
net.ipv4.conf.default.bootp_relay = 0
net.ipv4.conf.default.disable_policy = 0
net.ipv4.conf.default.disable_xfrm = 0
net.ipv4.conf.default.force_igmp_version = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.medium_id = 0
net.ipv4.conf.default.promote_secondaries = 0
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.default.proxy_arp_pvlan = 0
net.ipv4.conf.default.route_localnet = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.default.secure_redirects = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.default.shared_media = 1
net.ipv4.conf.default.src_valid_mark = 0
net.ipv4.conf.default.tag = 0
net.ipv4.conf.eth0.accept_local = 0
net.ipv4.conf.eth0.accept_redirects = 1
net.ipv4.conf.eth0.accept_source_route = 1
net.ipv4.conf.eth0.arp_accept = 0
net.ipv4.conf.eth0.arp_announce = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.arp_ignore = 0
net.ipv4.conf.eth0.arp_notify = 0
net.ipv4.conf.eth0.bootp_relay = 0
net.ipv4.conf.eth0.disable_policy = 0
net.ipv4.conf.eth0.disable_xfrm = 0
net.ipv4.conf.eth0.force_igmp_version = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.log_martians = 0
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.medium_id = 0
net.ipv4.conf.eth0.promote_secondaries = 0
net.ipv4.conf.eth0.proxy_arp = 0
net.ipv4.conf.eth0.proxy_arp_pvlan = 0
net.ipv4.conf.eth0.route_localnet = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0.secure_redirects = 1
net.ipv4.conf.eth0.send_redirects = 1
net.ipv4.conf.eth0.shared_media = 1
net.ipv4.conf.eth0.src_valid_mark = 0
net.ipv4.conf.eth0.tag = 0
net.ipv4.conf.lo.accept_local = 0
net.ipv4.conf.lo.accept_redirects = 1
net.ipv4.conf.lo.accept_source_route = 1
net.ipv4.conf.lo.arp_accept = 0
net.ipv4.conf.lo.arp_announce = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.arp_ignore = 0
net.ipv4.conf.lo.arp_notify = 0
net.ipv4.conf.lo.bootp_relay = 0
net.ipv4.conf.lo.disable_policy = 1
net.ipv4.conf.lo.disable_xfrm = 1
net.ipv4.conf.lo.force_igmp_version = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.medium_id = 0
net.ipv4.conf.lo.promote_secondaries = 0
net.ipv4.conf.lo.proxy_arp = 0
net.ipv4.conf.lo.proxy_arp_pvlan = 0
net.ipv4.conf.lo.route_localnet = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.lo.secure_redirects = 1
net.ipv4.conf.lo.send_redirects = 1
net.ipv4.conf.lo.shared_media = 1
net.ipv4.conf.lo.src_valid_mark = 0
net.ipv4.conf.lo.tag = 0
net.ipv4.conf.tun0.accept_local = 0
net.ipv4.conf.tun0.accept_redirects = 1
net.ipv4.conf.tun0.accept_source_route = 1
net.ipv4.conf.tun0.arp_accept = 0
net.ipv4.conf.tun0.arp_announce = 0
net.ipv4.conf.tun0.arp_filter = 0
net.ipv4.conf.tun0.arp_ignore = 0
net.ipv4.conf.tun0.arp_notify = 0
net.ipv4.conf.tun0.bootp_relay = 0
net.ipv4.conf.tun0.disable_policy = 0
net.ipv4.conf.tun0.disable_xfrm = 0
net.ipv4.conf.tun0.force_igmp_version = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.log_martians = 0
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.conf.tun0.medium_id = 0
net.ipv4.conf.tun0.promote_secondaries = 0
net.ipv4.conf.tun0.proxy_arp = 0
net.ipv4.conf.tun0.proxy_arp_pvlan = 0
net.ipv4.conf.tun0.route_localnet = 0
net.ipv4.conf.tun0.rp_filter = 0
net.ipv4.conf.tun0.secure_redirects = 1
net.ipv4.conf.tun0.send_redirects = 1
net.ipv4.conf.tun0.shared_media = 1
net.ipv4.conf.tun0.src_valid_mark = 0
net.ipv4.conf.tun0.tag = 0
net.ipv4.conf.tun1.accept_local = 0
net.ipv4.conf.tun1.accept_redirects = 1
net.ipv4.conf.tun1.accept_source_route = 1
net.ipv4.conf.tun1.arp_accept = 0
net.ipv4.conf.tun1.arp_announce = 0
net.ipv4.conf.tun1.arp_filter = 0
net.ipv4.conf.tun1.arp_ignore = 0
net.ipv4.conf.tun1.arp_notify = 0
net.ipv4.conf.tun1.bootp_relay = 0
net.ipv4.conf.tun1.disable_policy = 0
net.ipv4.conf.tun1.disable_xfrm = 0
net.ipv4.conf.tun1.force_igmp_version = 0
net.ipv4.conf.tun1.forwarding = 1
net.ipv4.conf.tun1.log_martians = 0
net.ipv4.conf.tun1.mc_forwarding = 0
net.ipv4.conf.tun1.medium_id = 0
net.ipv4.conf.tun1.promote_secondaries = 0
net.ipv4.conf.tun1.proxy_arp = 0
net.ipv4.conf.tun1.proxy_arp_pvlan = 0
net.ipv4.conf.tun1.route_localnet = 0
net.ipv4.conf.tun1.rp_filter = 0
net.ipv4.conf.tun1.secure_redirects = 1
net.ipv4.conf.tun1.send_redirects = 1
net.ipv4.conf.tun1.shared_media = 1
net.ipv4.conf.tun1.src_valid_mark = 0
net.ipv4.conf.tun1.tag = 0
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_errors_use_inbound_ifaddr = 0
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.icmp_ratelimit = 1000
net.ipv4.icmp_ratemask = 6168
net.ipv4.igmp_max_memberships = 20
net.ipv4.igmp_max_msf = 10
net.ipv4.inet_peer_maxttl = 600
net.ipv4.inet_peer_minttl = 120
net.ipv4.inet_peer_threshold = 65664
net.ipv4.ip_default_ttl = 64
net.ipv4.ip_dynaddr = 0
net.ipv4.ip_early_demux = 1
net.ipv4.ip_forward = 1
net.ipv4.ip_local_port_range = 32768    61000
net.ipv4.ip_local_reserved_ports = 
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.ip_nonlocal_bind = 0
net.ipv4.ipfrag_high_thresh = 262144
net.ipv4.ipfrag_low_thresh = 196608
net.ipv4.ipfrag_max_dist = 64
net.ipv4.ipfrag_secret_interval = 600
net.ipv4.ipfrag_time = 30
net.ipv4.neigh.default.anycast_delay = 100
net.ipv4.neigh.default.app_solicit = 0
net.ipv4.neigh.default.base_reachable_time_ms = 30000
net.ipv4.neigh.default.delay_first_probe_time = 5
net.ipv4.neigh.default.gc_interval = 30
net.ipv4.neigh.default.gc_stale_time = 60
net.ipv4.neigh.default.gc_thresh1 = 128
net.ipv4.neigh.default.gc_thresh2 = 512
net.ipv4.neigh.default.gc_thresh3 = 1024
net.ipv4.neigh.default.locktime = 100
net.ipv4.neigh.default.mcast_solicit = 3
net.ipv4.neigh.default.proxy_delay = 80
net.ipv4.neigh.default.proxy_qlen = 64
net.ipv4.neigh.default.retrans_time_ms = 1000
net.ipv4.neigh.default.ucast_solicit = 3
net.ipv4.neigh.default.unres_qlen = 34
net.ipv4.neigh.default.unres_qlen_bytes = 65536
net.ipv4.neigh.eth0.anycast_delay = 100
net.ipv4.neigh.eth0.app_solicit = 0
net.ipv4.neigh.eth0.base_reachable_time_ms = 30000
net.ipv4.neigh.eth0.delay_first_probe_time = 5
net.ipv4.neigh.eth0.gc_stale_time = 60
net.ipv4.neigh.eth0.locktime = 100
net.ipv4.neigh.eth0.mcast_solicit = 3
net.ipv4.neigh.eth0.proxy_delay = 80
net.ipv4.neigh.eth0.proxy_qlen = 64
net.ipv4.neigh.eth0.retrans_time_ms = 1000
net.ipv4.neigh.eth0.ucast_solicit = 3
net.ipv4.neigh.eth0.unres_qlen = 34
net.ipv4.neigh.eth0.unres_qlen_bytes = 65536
net.ipv4.neigh.lo.anycast_delay = 100
net.ipv4.neigh.lo.app_solicit = 0
net.ipv4.neigh.lo.base_reachable_time_ms = 30000
net.ipv4.neigh.lo.delay_first_probe_time = 5
net.ipv4.neigh.lo.gc_stale_time = 60
net.ipv4.neigh.lo.locktime = 100
net.ipv4.neigh.lo.mcast_solicit = 3
net.ipv4.neigh.lo.proxy_delay = 80
net.ipv4.neigh.lo.proxy_qlen = 64
net.ipv4.neigh.lo.retrans_time_ms = 1000
net.ipv4.neigh.lo.ucast_solicit = 3
net.ipv4.neigh.lo.unres_qlen = 34
net.ipv4.neigh.lo.unres_qlen_bytes = 65536
net.ipv4.neigh.tun0.anycast_delay = 100
net.ipv4.neigh.tun0.app_solicit = 0
net.ipv4.neigh.tun0.base_reachable_time_ms = 30000
net.ipv4.neigh.tun0.delay_first_probe_time = 5
net.ipv4.neigh.tun0.gc_stale_time = 60
net.ipv4.neigh.tun0.locktime = 100
net.ipv4.neigh.tun0.mcast_solicit = 3
net.ipv4.neigh.tun0.proxy_delay = 80
net.ipv4.neigh.tun0.proxy_qlen = 64
net.ipv4.neigh.tun0.retrans_time_ms = 1000
net.ipv4.neigh.tun0.ucast_solicit = 3
net.ipv4.neigh.tun0.unres_qlen = 34
net.ipv4.neigh.tun0.unres_qlen_bytes = 65536
net.ipv4.neigh.tun1.anycast_delay = 100
net.ipv4.neigh.tun1.app_solicit = 0
net.ipv4.neigh.tun1.base_reachable_time_ms = 30000
net.ipv4.neigh.tun1.delay_first_probe_time = 5
net.ipv4.neigh.tun1.gc_stale_time = 60
net.ipv4.neigh.tun1.locktime = 100
net.ipv4.neigh.tun1.mcast_solicit = 3
net.ipv4.neigh.tun1.proxy_delay = 80
net.ipv4.neigh.tun1.proxy_qlen = 64
net.ipv4.neigh.tun1.retrans_time_ms = 1000
net.ipv4.neigh.tun1.ucast_solicit = 3
net.ipv4.neigh.tun1.unres_qlen = 34
net.ipv4.neigh.tun1.unres_qlen_bytes = 65536
net.ipv4.ping_group_range = 1   0
net.ipv4.route.error_burst = 1000
net.ipv4.route.error_cost = 200
net.ipv4.route.gc_elasticity = 8
net.ipv4.route.gc_interval = 60
net.ipv4.route.gc_min_interval = 0
net.ipv4.route.gc_min_interval_ms = 500
net.ipv4.route.gc_thresh = -1
net.ipv4.route.gc_timeout = 300
net.ipv4.route.max_size = 2147483647
net.ipv4.route.min_adv_mss = 256
net.ipv4.route.min_pmtu = 552
net.ipv4.route.mtu_expires = 600
net.ipv4.route.redirect_load = 4
net.ipv4.route.redirect_number = 9
net.ipv4.route.redirect_silence = 4096
net.ipv4.tcp_abc = 0
net.ipv4.tcp_abort_on_overflow = 0
net.ipv4.tcp_adv_win_scale = 1
net.ipv4.tcp_allowed_congestion_control = cubic reno
net.ipv4.tcp_app_win = 31
net.ipv4.tcp_available_congestion_control = cubic reno
net.ipv4.tcp_base_mss = 512
net.ipv4.tcp_challenge_ack_limit = 100
net.ipv4.tcp_congestion_control = cubic
net.ipv4.tcp_cookie_size = 0
net.ipv4.tcp_dsack = 1
net.ipv4.tcp_early_retrans = 2
net.ipv4.tcp_ecn = 2
net.ipv4.tcp_fack = 1
net.ipv4.tcp_fastopen = 0
net.ipv4.tcp_fastopen_key = c05088f1-d083d613-5a06e2cd-9d77a930
net.ipv4.tcp_fin_timeout = 60
net.ipv4.tcp_frto = 2
net.ipv4.tcp_frto_response = 0
net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_time = 7200
net.ipv4.tcp_limit_output_bytes = 131072
net.ipv4.tcp_low_latency = 0
net.ipv4.tcp_max_orphans = 4096
net.ipv4.tcp_max_ssthresh = 0
net.ipv4.tcp_max_syn_backlog = 128
net.ipv4.tcp_max_tw_buckets = 4096
net.ipv4.tcp_mem = 17973        23965   35946
net.ipv4.tcp_moderate_rcvbuf = 1
net.ipv4.tcp_mtu_probing = 0
net.ipv4.tcp_no_metrics_save = 0
net.ipv4.tcp_orphan_retries = 0
net.ipv4.tcp_reordering = 3
net.ipv4.tcp_retrans_collapse = 1
net.ipv4.tcp_retries1 = 3
net.ipv4.tcp_retries2 = 15
net.ipv4.tcp_rfc1337 = 0
net.ipv4.tcp_rmem = 4096        87380   6177280
net.ipv4.tcp_sack = 1
net.ipv4.tcp_slow_start_after_idle = 1
net.ipv4.tcp_stdurg = 0
net.ipv4.tcp_syn_retries = 6
net.ipv4.tcp_synack_retries = 5
net.ipv4.tcp_thin_dupack = 0
net.ipv4.tcp_thin_linear_timeouts = 0
net.ipv4.tcp_timestamps = 1
net.ipv4.tcp_tso_win_divisor = 3
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 0
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_wmem = 4096        16384   4194304
net.ipv4.tcp_workaround_signed_windows = 0
net.ipv4.udp_mem = 18096        24130   36192
net.ipv4.udp_rmem_min = 4096
net.ipv4.udp_wmem_min = 4096
net.ipv4.xfrm4_gc_thresh = 1024
net.ipv6.bindv6only = 0
net.ipv6.conf.all.accept_dad = 1
net.ipv6.conf.all.accept_ra = 1
net.ipv6.conf.all.accept_ra_defrtr = 1
net.ipv6.conf.all.accept_ra_pinfo = 1
net.ipv6.conf.all.accept_redirects = 1
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.all.autoconf = 1
net.ipv6.conf.all.dad_transmits = 1
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.all.force_mld_version = 0
net.ipv6.conf.all.force_tllao = 0
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.all.hop_limit = 64
net.ipv6.conf.all.max_addresses = 16
net.ipv6.conf.all.mtu = 1280
net.ipv6.conf.all.ndisc_notify = 0
net.ipv6.conf.all.proxy_ndp = 0
net.ipv6.conf.all.router_solicitation_delay = 1
net.ipv6.conf.all.router_solicitation_interval = 4
net.ipv6.conf.all.router_solicitations = 3
net.ipv6.conf.default.accept_dad = 1
net.ipv6.conf.default.accept_ra = 1
net.ipv6.conf.default.accept_ra_defrtr = 1
net.ipv6.conf.default.accept_ra_pinfo = 1
net.ipv6.conf.default.accept_redirects = 1
net.ipv6.conf.default.accept_source_route = 0
net.ipv6.conf.default.autoconf = 1
net.ipv6.conf.default.dad_transmits = 1
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.default.force_mld_version = 0
net.ipv6.conf.default.force_tllao = 0
net.ipv6.conf.default.forwarding = 1
net.ipv6.conf.default.hop_limit = 64
net.ipv6.conf.default.max_addresses = 16
net.ipv6.conf.default.mtu = 1280
net.ipv6.conf.default.ndisc_notify = 0
net.ipv6.conf.default.proxy_ndp = 0
net.ipv6.conf.default.router_solicitation_delay = 1
net.ipv6.conf.default.router_solicitation_interval = 4
net.ipv6.conf.default.router_solicitations = 3
net.ipv6.conf.eth0.accept_dad = 1
net.ipv6.conf.eth0.accept_ra = 1
net.ipv6.conf.eth0.accept_ra_defrtr = 1
net.ipv6.conf.eth0.accept_ra_pinfo = 1
net.ipv6.conf.eth0.accept_redirects = 1
net.ipv6.conf.eth0.accept_source_route = 0
net.ipv6.conf.eth0.autoconf = 0
net.ipv6.conf.eth0.dad_transmits = 1
net.ipv6.conf.eth0.disable_ipv6 = 0
net.ipv6.conf.eth0.force_mld_version = 0
net.ipv6.conf.eth0.force_tllao = 0
net.ipv6.conf.eth0.forwarding = 1
net.ipv6.conf.eth0.hop_limit = 64
net.ipv6.conf.eth0.max_addresses = 16
net.ipv6.conf.eth0.mtu = 1500
net.ipv6.conf.eth0.ndisc_notify = 0
net.ipv6.conf.eth0.proxy_ndp = 0
net.ipv6.conf.eth0.router_solicitation_delay = 1
net.ipv6.conf.eth0.router_solicitation_interval = 4
net.ipv6.conf.eth0.router_solicitations = 3
net.ipv6.conf.lo.accept_dad = -1
net.ipv6.conf.lo.accept_ra = 1
net.ipv6.conf.lo.accept_ra_defrtr = 1
net.ipv6.conf.lo.accept_ra_pinfo = 1
net.ipv6.conf.lo.accept_redirects = 1
net.ipv6.conf.lo.accept_source_route = 0
net.ipv6.conf.lo.autoconf = 1
net.ipv6.conf.lo.dad_transmits = 1
net.ipv6.conf.lo.disable_ipv6 = 0
net.ipv6.conf.lo.force_mld_version = 0
net.ipv6.conf.lo.force_tllao = 0
net.ipv6.conf.lo.forwarding = 1
net.ipv6.conf.lo.hop_limit = 64
net.ipv6.conf.lo.max_addresses = 16
net.ipv6.conf.lo.mtu = 65536
net.ipv6.conf.lo.ndisc_notify = 0
net.ipv6.conf.lo.proxy_ndp = 0
net.ipv6.conf.lo.router_solicitation_delay = 1
net.ipv6.conf.lo.router_solicitation_interval = 4
net.ipv6.conf.lo.router_solicitations = 3
net.ipv6.conf.tun0.accept_dad = -1
net.ipv6.conf.tun0.accept_ra = 1
net.ipv6.conf.tun0.accept_ra_defrtr = 1
net.ipv6.conf.tun0.accept_ra_pinfo = 1
net.ipv6.conf.tun0.accept_redirects = 1
net.ipv6.conf.tun0.accept_source_route = 0
net.ipv6.conf.tun0.autoconf = 1
net.ipv6.conf.tun0.dad_transmits = 1
net.ipv6.conf.tun0.disable_ipv6 = 0
net.ipv6.conf.tun0.force_mld_version = 0
net.ipv6.conf.tun0.force_tllao = 0
net.ipv6.conf.tun0.forwarding = 1
net.ipv6.conf.tun0.hop_limit = 64
net.ipv6.conf.tun0.max_addresses = 16
net.ipv6.conf.tun0.mtu = 47520
net.ipv6.conf.tun0.ndisc_notify = 0
net.ipv6.conf.tun0.proxy_ndp = 0
net.ipv6.conf.tun0.router_solicitation_delay = 1
net.ipv6.conf.tun0.router_solicitation_interval = 4
net.ipv6.conf.tun0.router_solicitations = 3
net.ipv6.conf.tun1.accept_dad = -1
net.ipv6.conf.tun1.accept_ra = 1
net.ipv6.conf.tun1.accept_ra_defrtr = 1
net.ipv6.conf.tun1.accept_ra_pinfo = 1
net.ipv6.conf.tun1.accept_redirects = 1
net.ipv6.conf.tun1.accept_source_route = 0
net.ipv6.conf.tun1.autoconf = 1
net.ipv6.conf.tun1.dad_transmits = 1
net.ipv6.conf.tun1.disable_ipv6 = 0
net.ipv6.conf.tun1.force_mld_version = 0
net.ipv6.conf.tun1.force_tllao = 0
net.ipv6.conf.tun1.forwarding = 1
net.ipv6.conf.tun1.hop_limit = 64
net.ipv6.conf.tun1.max_addresses = 16
net.ipv6.conf.tun1.mtu = 48000
net.ipv6.conf.tun1.ndisc_notify = 0
net.ipv6.conf.tun1.proxy_ndp = 0
net.ipv6.conf.tun1.router_solicitation_delay = 1
net.ipv6.conf.tun1.router_solicitation_interval = 4
net.ipv6.conf.tun1.router_solicitations = 3
net.ipv6.icmp.ratelimit = 1000
net.ipv6.ip6frag_high_thresh = 262144
net.ipv6.ip6frag_low_thresh = 196608
net.ipv6.ip6frag_secret_interval = 600
net.ipv6.ip6frag_time = 60
net.ipv6.mld_max_msf = 64
net.ipv6.neigh.default.anycast_delay = 100
net.ipv6.neigh.default.app_solicit = 0
net.ipv6.neigh.default.base_reachable_time_ms = 30000
net.ipv6.neigh.default.delay_first_probe_time = 5
net.ipv6.neigh.default.gc_interval = 30
net.ipv6.neigh.default.gc_stale_time = 60
net.ipv6.neigh.default.gc_thresh1 = 128
net.ipv6.neigh.default.gc_thresh2 = 512
net.ipv6.neigh.default.gc_thresh3 = 1024
net.ipv6.neigh.default.locktime = 0
net.ipv6.neigh.default.mcast_solicit = 3
net.ipv6.neigh.default.proxy_delay = 80
net.ipv6.neigh.default.proxy_qlen = 64
net.ipv6.neigh.default.retrans_time_ms = 1000
net.ipv6.neigh.default.ucast_solicit = 3
net.ipv6.neigh.default.unres_qlen = 34
net.ipv6.neigh.default.unres_qlen_bytes = 65536
net.ipv6.neigh.eth0.anycast_delay = 100
net.ipv6.neigh.eth0.app_solicit = 0
net.ipv6.neigh.eth0.base_reachable_time_ms = 30000
net.ipv6.neigh.eth0.delay_first_probe_time = 5
net.ipv6.neigh.eth0.gc_stale_time = 60
net.ipv6.neigh.eth0.locktime = 0
net.ipv6.neigh.eth0.mcast_solicit = 3
net.ipv6.neigh.eth0.proxy_delay = 80
net.ipv6.neigh.eth0.proxy_qlen = 64
net.ipv6.neigh.eth0.retrans_time_ms = 1000
net.ipv6.neigh.eth0.ucast_solicit = 3
net.ipv6.neigh.eth0.unres_qlen = 34
net.ipv6.neigh.eth0.unres_qlen_bytes = 65536
net.ipv6.neigh.lo.anycast_delay = 100
net.ipv6.neigh.lo.app_solicit = 0
net.ipv6.neigh.lo.base_reachable_time_ms = 30000
net.ipv6.neigh.lo.delay_first_probe_time = 5
net.ipv6.neigh.lo.gc_stale_time = 60
net.ipv6.neigh.lo.locktime = 0
net.ipv6.neigh.lo.mcast_solicit = 3
net.ipv6.neigh.lo.proxy_delay = 80
net.ipv6.neigh.lo.proxy_qlen = 64
net.ipv6.neigh.lo.retrans_time_ms = 1000
net.ipv6.neigh.lo.ucast_solicit = 3
net.ipv6.neigh.lo.unres_qlen = 34
net.ipv6.neigh.lo.unres_qlen_bytes = 65536
net.ipv6.neigh.tun0.anycast_delay = 100
net.ipv6.neigh.tun0.app_solicit = 0
net.ipv6.neigh.tun0.base_reachable_time_ms = 30000
net.ipv6.neigh.tun0.delay_first_probe_time = 5
net.ipv6.neigh.tun0.gc_stale_time = 60
net.ipv6.neigh.tun0.locktime = 0
net.ipv6.neigh.tun0.mcast_solicit = 3
net.ipv6.neigh.tun0.proxy_delay = 80
net.ipv6.neigh.tun0.proxy_qlen = 64
net.ipv6.neigh.tun0.retrans_time_ms = 1000
net.ipv6.neigh.tun0.ucast_solicit = 3
net.ipv6.neigh.tun0.unres_qlen = 34
net.ipv6.neigh.tun0.unres_qlen_bytes = 65536
net.ipv6.neigh.tun1.anycast_delay = 100
net.ipv6.neigh.tun1.app_solicit = 0
net.ipv6.neigh.tun1.base_reachable_time_ms = 30000
net.ipv6.neigh.tun1.delay_first_probe_time = 5
net.ipv6.neigh.tun1.gc_stale_time = 60
net.ipv6.neigh.tun1.locktime = 0
net.ipv6.neigh.tun1.mcast_solicit = 3
net.ipv6.neigh.tun1.proxy_delay = 80
net.ipv6.neigh.tun1.proxy_qlen = 64
net.ipv6.neigh.tun1.retrans_time_ms = 1000
net.ipv6.neigh.tun1.ucast_solicit = 3
net.ipv6.neigh.tun1.unres_qlen = 34
net.ipv6.neigh.tun1.unres_qlen_bytes = 65536
net.ipv6.route.gc_elasticity = 9
net.ipv6.route.gc_interval = 30
net.ipv6.route.gc_min_interval = 0
net.ipv6.route.gc_min_interval_ms = 500
net.ipv6.route.gc_thresh = 1024
net.ipv6.route.gc_timeout = 60
net.ipv6.route.max_size = 4096
net.ipv6.route.min_adv_mss = 1220
net.ipv6.route.mtu_expires = 600
net.ipv6.xfrm6_gc_thresh = 1024
net.netfilter.nf_log.0 = NONE
net.netfilter.nf_log.1 = NONE
net.netfilter.nf_log.10 = NONE
net.netfilter.nf_log.11 = NONE
net.netfilter.nf_log.12 = NONE
net.netfilter.nf_log.2 = NONE
net.netfilter.nf_log.3 = NONE
net.netfilter.nf_log.4 = NONE
net.netfilter.nf_log.5 = NONE
net.netfilter.nf_log.6 = NONE
net.netfilter.nf_log.7 = NONE
net.netfilter.nf_log.8 = NONE
net.netfilter.nf_log.9 = NONE
net.phonet.local_port_range = 64        127
net.unix.max_dgram_qlen = 10
vm.block_dump = 0
vm.dirty_background_bytes = 0
vm.dirty_background_ratio = 10
vm.dirty_bytes = 0
vm.dirty_expire_centisecs = 3000
vm.dirty_ratio = 20
vm.dirty_writeback_centisecs = 500
vm.drop_caches = 0
vm.extfrag_threshold = 500
vm.highmem_is_dirtyable = 0
vm.laptop_mode = 0
vm.legacy_va_layout = 0
vm.lowmem_reserve_ratio = 32    32
vm.max_map_count = 65530
vm.min_free_kbytes = 3514
vm.mmap_min_addr = 4096
vm.nr_pdflush_threads = 0
vm.oom_dump_tasks = 1
vm.oom_kill_allocating_task = 0
vm.overcommit_memory = 0
vm.overcommit_ratio = 50
vm.page-cluster = 3
vm.panic_on_oom = 0
vm.percpu_pagelist_fraction = 0
vm.scan_unevictable_pages = 0
vm.stat_interval = 1
vm.swappiness = 60
vm.vfs_cache_pressure = 100

so if encryption is not the bottleneck, what else could be?
thanks for any advice in advance
if you need output of any other commands to investigate further, please let me know and I will provide it ASAP

gac

The Ethernet controller is a USB chip, which don't traditionally perform well on embedded devices.

totaluser

thanks for the reply
that indeed seems plausible, even though ethernet chip is communication via separate USB port with SoC CPU

today I was copying files via SCP towards odroid (without VPN, via directly connected 1Gbps LAN) and the rate was 88Mbps throughout the whole transfer (2GB large archive)
so mostly unidirectional flow can almost saturate 100Mbps Ethernet interface on Odroid

I tried transferring files using Samba and I also achieved 11MB/s --> 88Mbps transfer rate with mostly unidirectional flow
I tried 2 simultaneous transfers in both direction using Samba and there was reduction in speed (almost 50%)

as can be seen on picture
now I don't know if this is Ethernet bottleneck of the USB pendrive that I use for my samba share storage (simultaneous read and write always hurts performance on flashdrives in my experience)

I also used iperf to test unidirectional and bidirectional flows

unidirectional performance is excellent

iperf -c 10.11.12.109 -t 120
------------------------------------------------------------
Client connecting to 10.11.12.109, TCP port 5001
TCP window size: 18.7 KByte (default)
------------------------------------------------------------
[  3] local 10.11.12.254 port 46930 connected with 10.11.12.109 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-120.0 sec  1.26 GBytes  89.8 Mbits/sec
odroid@odroidu2:~$ iperf -c 10.11.12.109 -t 120
------------------------------------------------------------
Client connecting to 10.11.12.109, TCP port 5001
TCP window size: 18.7 KByte (default)
------------------------------------------------------------
[  3] local 10.11.12.254 port 46933 connected with 10.11.12.109 port 5001
[ ID] Interval       Transfer     Bandwidth
[  3]  0.0-120.0 sec  1.25 GBytes  89.8 Mbits/sec

bidirectional tests also show reduction in speed, though not as dramatic as samba transfer
clearly USB ethernet chip cannot provide 200Mbps Full Duplex speeds (100Mbps in each direction)

iperf -c 10.11.12.109 -t 120 -d
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
------------------------------------------------------------
Client connecting to 10.11.12.109, TCP port 5001
TCP window size: 67.4 KByte (default)
------------------------------------------------------------
[  5] local 10.11.12.254 port 46934 connected with 10.11.12.109 port 5001
[  4] local 10.11.12.254 port 5001 connected with 10.11.12.109 port 58111
[ ID] Interval       Transfer     Bandwidth
[  5]  0.0-120.0 sec   941 MBytes  65.8 Mbits/sec
[  4]  0.0-120.0 sec   988 MBytes  69.0 Mbits/sec
odroid@odroidu2:~$ iperf -c 10.11.12.109 -t 120 -d
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 85.3 KByte (default)
------------------------------------------------------------
------------------------------------------------------------
Client connecting to 10.11.12.109, TCP port 5001
TCP window size: 71.1 KByte (default)
------------------------------------------------------------
[  5] local 10.11.12.254 port 46935 connected with 10.11.12.109 port 5001
[  4] local 10.11.12.254 port 5001 connected with 10.11.12.109 port 58133
[ ID] Interval       Transfer     Bandwidth
[  5]  0.0-120.0 sec   937 MBytes  65.5 Mbits/sec
[  4]  0.0-120.0 sec   980 MBytes  68.5 Mbits/sec

my use case, using VPN to transfer files between desktop in LAN network at home and laptop connected via VPN
in this case data from desktop is received in RX direction, encrypting and encapsulating it and then sending to the router in TX direction
flash is not involved in this case since files are not stored on the Odroid device itself

during this bidirectional test, CPU usage is following

so even though USB Ethernet chips IS the bottleneck in maximum transfer speed, it does not answer my question

if Crypto is not the bottleneck (disabling encryption and and authentication does not increase OpenVPN throughput significantly)
even if Ethernet chip IS bottleneck, why is openVPN throughput so significantly less (36 or 38Mbps compared to ~65Mbps)

if I could achieve ~50-55Mbps via OpenVPN tunnel I would be very happy
is there anything I can tweak to increase througput?
some OpenVPN configuration parameter?
recompile OpenVPN with some fancy optimizations? (though I guess when compiling natively on Odroid GCC uses all available optimizations for this architecture)
some kernel tweak via sysctl?
recompiling kernel with some non-default options enabled?

thanks in advance

totaluser

OK, so I spent the whole night testing performance and tweaking configuration and here are the results

at first I have to say windows and samba was not the best choice to measure performance
I obtained remote access to the machine at the university and did some testing with iperf and openvpn 2.3.4 compiled from sources

TCP over TCP AES-128-CBC + SHA1 --> 47.5 mbps
TCP over TCP none + none -----------> 49-50 mbps

with these promising results I repeated iperf measurements a few times to see if they are consistent and they were
I continued to test with UDP as that should increase performance over TCP

TCP over UDP AES-256-CBC + SHA1 --> 41 mbps
TCP over UDP AES-128-CBC + SHA1 --> 44 mbps
TCP over UDP none + none -----------> 57 mbps
TCP over UDP none + none -----------> 58.5 mbps  (after overclocking exynos 4412 from 1.7GHz to 1.92GHz)

with such promising results I investigated further what is more expensive, AES encryption or SHA1 HMAC digest calculation

TCP over UDP AES-256-CBC + none ----> 51.5 mbps  (after overclocking exynos 4412 from 1.7GHz to 1.92GHz)
TCP over UDP AES-128-CBC + none ----> 53.7 mbps  (after overclocking exynos 4412 from 1.7GHz to 1.92GHz)

it looks like SHA1 is more expensive to calculate so I tested it with MD5 HMAC instead

TCP over UDP AES-128-CBC + MD5 ----> 51.7 mbps  (after overclocking exynos 4412 from 1.7GHz to 1.92GHz)

so I added / modified this in my config in 1st post

 cipher AES-128-CBC
 auth MD5
 tun-mtu 1500
 mssfix 1400

so with these result I went to test it in person with my laptop (Intel SU7300)
when I booted into Ubuntu 14.04 64-bit and openvpn 2.3.4 compiled from sources and tested with iperf I was getting the same results as above

so the conclusion is that VPN delivers :twisted:
I went to test it in Windows 7 Professional x64 and openvpn 2.3.4 64-bit

with the same iperf commands I was getting ~35mbps and was quite surprised
so I rebooted back to Ubuntu to verify if something is wrong with the network or with windows
sure enough, ubuntu and VPN delivered ~50mbps in one direction and after switching client/server between each other ~59mbps in opposite direction

back to windows and iperf still showing ~35mbps

Y:\TMP\iperf>iperf.exe -s
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte (default)
------------------------------------------------------------

the default window size of 64KB seems as either a lie or something is seriously wrong, because after manually specifying 64KB window size

Y:\TMP\iperf>iperf.exe -s -w 64k
------------------------------------------------------------
Server listening on TCP port 5001
TCP window size: 64.0 KByte
------------------------------------------------------------

speeds were quite close to what linux delivered
atheros AR8132 and not excellent drivers (compared to Intel NICs) probably also contribute to a bit lower speeds

so to sum it up, I am getting the performance I wanted

I will test application performance later and more thoroughly, as application speed (samba, ftp) did not get anywhere near to what iperf measured

thanks for your replies and suggestions