FreeBSD Router Problem

[Pierre Lamy]

states        hard limit    10000

If I want to dos this box all I need to do is hold 10k tcp connections 
open in established.

A 1 day default timeout for established connections is retarded, since 
virtually all client apps and OSs as well as intervening stateful 
firewalls will lose state after 1 hour. A session which is idle for more 
than an hour can't be considered to be active. Coupled with an extremely 
low state limit, and you're asking for problems. If the session is 
active at all before the session timeout is hit, the timer is reset.

I'm not saying he's getting DOSd, but with such low limits, even a 
normal home network is going to run into problems at some point. We can 
see from the diagnostic output provided earlier that there were no 
issues when it was collected, but was it collected while there was an 
outage?

If the problem still occurs, it may be worth scripting something to 
collect some pfctl -g -v -v -v -s all and some sysctl -a, vmstat output 
as well.

Pierre

Adrian Penisoara wrote:
> Hi,
>
> On Wed, Mar 25, 2009 at 11:21 PM, Shawn Everett <shawn at tandac.com> wrote:
>
>   
>>> tcp.established           86400s
>>>
>>> ^^ This should be 3600.
>>>
>>> Pierre
>>>       
>> That's an interesting thought.  Why would that matter?
>>     
>
>
> It's the PF TCP established session timeout, which defaults to 1 day. This
> is relevant only if you see a lot of ESTABLISHED sessions in the 'pfctl -s
> state' output, which appears not to be the case...
>
>
> Regards,
> Adrian.
> _______________________________________________
> freebsd-net at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-net
> To unsubscribe, send any mail to "freebsd-net-unsubscribe at freebsd.org"
>