Determining where mbufs are in use

[Peter Jeremy]

I think I have a system that is leaking mbufs and I'd like some ideas
on how to track down what mbufs are in use.

Background: The system is running 4.9p1 and has been up for about 8
months.  I haven't noticed any problems before.  This afternoon, I
opened an xterm, did an slogin to another system and ran "ipfw l" on
that system.  The output froze about halfway through and I noticed
that my system was barely responding.  A check of the console showed
that the system was out of mbuf clusters (1024).

I killed a couple of ssh sessions and the in-use mbufs and clusters
dropped to 440 but that still strikes me as excessive.  My laptop
shows 12 clusters in use with a maximum of 74 after a month of
uptime.

The system in question is my main workstation at work.  It has dual
heads with a virtual WM and I tend to have lots of xterms open (maybe
50-60, both local and ssh).  It's an NFS client but not server.
netstat showed only a couple of dozen TCP sockets, though there are
a lot of Unix domain sockets (for X) - none had any data queued.

Is there any easy way to work out where all the mbufs have gone?

-- 
Peter Jeremy