CURRENT: ipfw: problems with timeouts and worse network performance

[O. Hartmann]

Am Fri, 20 May 2016 15:28:35 +0200
Jan Bramkamp <crest at rlwinm.de> schrieb:

> On 20/05/16 14:54, Vladimir Zakharov wrote:
> > Hello
> >
> > On Fri, May 20, 2016, O. Hartmann wrote:  
> >> I reported earlier about broken pipes in ssh sessions to remote hosts,
> >> which occur on an erratic basis. i'm investigating this problem now and
> >> it seems that it is also ipfw-related, but I'm not sure. This problem
> >> is present since a couple of weeks now.  
> >
> > Maybe this could help...
> >
> > I've also experienced problems with broken pipes in ssh sessions some
> > time ago. Setting in sysctl.conf
> >
> > net.inet.ip.fw.dyn_ack_lifetime=3600
> >
> > fixed problem for me. I didn't experiment with the value though. So,
> > possibly, changing default value (300s) to 1 hour is overkill :).  
> 
> By default the OpenSSH SSH client is configured to use TCP keepalives. 
> Those should produce enough packets at a short enough interval to keep 
> the dynamic IPFW state established.
> 
> Does your traffic pass through libalias?

YES and NO. My private setup at home/home office uses NAT/libalias (kernel NAT), but at
work and department its straight forward.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freebsd.org/pipermail/freebsd-current/attachments/20160520/28e830e3/attachment.sig>