kernel: ipfw: install_state: Too many dynamic rules
Patrick
patrick at esoltani.com
Fri Sep 10 13:35:25 PDT 2004
Ben Bentsen wrote:
> Hello group,
>
> Can any shed a little light on the following error messages. I have
> spent a great deal of time looking at what is running at about
> 9:30am-9:45am and have found nothing that I can pin to these errors. No
> cron jobs are running anywhere even close to the time. TCPdump does not
> shed any light either. This machine has only one purpose to pass, count,
> limit and deny packets to a network Only SSH and FTP services are
> enabled on this machine. What conditions case this message maybe I am
> looking in the wrong place.
>
> INET ---- This Machine --- Catalyst 2820 ------ 14 computer units
>
> Aug 7 09:41:34 7206 /kernel: ipfw: install_state: Too many dynamic rules
> Aug 10 09:41:207206 /kernel: ipfw: install_state: Too many dynamic rules
> Aug 13 09:41:31 7206 /kernel: ipfw: install_state: Too many dynamic rules
You see these because you have most of your rules setup to utilize the
keep-state stuff (stateful thingy).
couple of things you can do:
#sysctl -a | grep bucket
net.inet.ip.fw.dyn_buckets: 256
which is default, at least on 5.2.1, should be the same on 4.x
increasing this will require more memory, but should give *some* relief.
make an explicit rule for outgoing packets.
Regards,
Patrick Soltani.
More information about the freebsd-ipfw
mailing list