ipfw: Too many dynamic rules

[Gareth de Vaux]

Hi again, I use some keep-state rules in ipfw, but get the following
kernel message:

kernel: ipfw: install_state: Too many dynamic rules

when presumably my state table reaches its limit (and I effectively
get DoS'd).

netstat shows tons of connections in FIN_WAIT_2 state, mostly to
my webserver. Consequently net.inet.ip.fw.dyn_count is large too.

I can increase my net.inet.ip.fw.dyn_max but the new limit will
simply be reached later on.

I currently get around this with a cronjob that sets
net.inet.ip.fw.dyn_keepalive to 0 for just less than 5 minutes
every night. If I leave it at 0 for longer or indefinitely then
idle ssh sessions and the like are dropped. This works fine for
me but it looks like there's some bug with net.inet.ip.fw.dyn_keepalive=1?
Or with Apache?

I'm using 8.1-STABLE, GENERIC kernel. Experienced the same behaviour
on 8.0-RELEASE, but not on 6.1-RELEASE where I had a similar setup. I
have a KeepAliveTimeout of 4 in Apache (2.2.16).