A huge amount of "sonewconn: pcb 0xfffffe0053916dc8: Listen queue overflow: 193 already in queue awaiting acceptance" in logs recently (9-STABLE)

[Andre Oppermann]

On 25.07.2013 12:46, Lev Serebryakov wrote:
> Hello, Freebsd-net.
>
>   I have 9.1-STABLE r253105 system, which started to flood logs with
>   "sonewconn: pcb 0xfffffe0053916dc8: Listen queue overflow: 193 already in
> queue awaiting acceptance" messages (there are thousnds of it, if you take
> "last message was repeated 600 times" in account).
>
>   Nothing was changed in settings for long time.
>
>   How could I determine, which connections (listen port, at least) cause
> these messages?

This means the rate of incoming connection attempts is grater than the speed
of the application accepting them.  Typically you either suffer from a DoS
attack or your server is undersized for the amount of traffic it is receiving.

A change to rate-limit the number of these messages is in the works to prevent
it filling from the logs too fast.

-- 
Andre