ipfw: Too many dynamic rules

[Jeremy Chadwick]

On Tue, Sep 14, 2010 at 12:36:57PM +0200, Gareth de Vaux wrote:
> On Fri 2010-09-10 (13:49), Gareth de Vaux wrote:
> > > Thirdly, if you feel FIN_WAIT2 is the cause of your problem, then you
> > > should consider adjusting the following sysctl:
> > > 
> > > net.inet.tcp.finwait2_timeout
> > > 
> > > Try something like 15000 (15 seconds) instead of the default (60000).
> > 
> > Ok that seems to be doing something. Will report back later.
> 
> Nope it's not helping. That and/or dropping net.inet.ip.fw.dyn_ack_lifetime.

You're absolutely certain these are all in FIN_WAIT_2 state and not
TIME_WAIT?

-- 
| Jeremy Chadwick                                   jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |