Whether IPFW generates " No buffer space available " error ?

[Mark Felder]

On Sat, Apr 23, 2016, at 01:46, samira wrote:
> Hi everyone,
> I using FreeBSD9.2 and defining a rule in ipfw that divert tcp packets on
> port 80 to port 8000 and by suricata will be reviewed.
> ipfw list:
> 01901 divert 8000 tcp from any to any dst-port 80
> 
> And then the packets is sent by altq to queue defined
> ipfw list:
> 03009 skipto 3011 tcp from any to any dst-port 80
> 03010 skipto 3012 ip from any to any
> 03011 allow altq http-gbeth3-out ip from any to any via gbeth3 out
> 
> And we limit bandwidth in pf.conf for http traffic
> pf.conf:
> queue http-gbeth3-out bandwidth 50Kb  hfsc (  upperlimit 50Kb )
> 
> When the transmission of huge amounts of http packets and pf action is to
> drop packets, suricata crash and the following message appears in the
> suricata.log file:
> <Warning> - [ERRCODE: SC_WARN_IPFW_XMIT(84)] - Write to ipfw divert
> socket
> failed: No buffer space available
> 
> Has anyone dealt with this issue?
> 
> There is a similar problem:
> By sending ICMP packets to the queue and send ping from the interface
> also
> seen this problem  and the following message is displayed:
>  ping: sendto: No buffer space available
> 
> 
> If the specified bandwidth increased and not drop any packets, this
> problem
> does not occur.
> 
> Thank you for all of your comments and help. 
> 
> 

I ran into this "No buffer space available" problem when I was first
setting up QoS on my IPFW firewall. The problem ended up being an issue
with my IPFW/QoS rules combined with my NAT; the order of my rules was
incorrect and I think packets kept getting reprocessed. I can't be sure
of the issue in your situation, but you may want to carefully review
your entire ruleset. Remember that IPFW is "first match wins".

-- 
  Mark Felder
  ports-secteam member
  feld at FreeBSD.org