Performance/lockup issues with FreeBSD as a router

[Peter Kieser]

Quoting Charles Swiger <cswiger at mac.com>:

> On May 26, 2005, at 1:47 PM, Peter Kieser wrote:
> > The nics are if_dc, this is a stock FreeBSD 5.4-RELEASE  
> > installation (no
> > firewall or anything):
> >
> > Here's my /etc/sysctl.conf:
> >
> > net.inet.ip.rtexpire=1800
> > net.inet.ip.rtminexpire=1800
> > kern.maxfiles=32768
> > kern.maxfilesperproc=32768
> > kern.ipc.somaxconn=32767
> > net.inet.tcp.sendspace=256000
> > net.inet.tcp.recvspace=256000
> > kern.ipc.maxsockbuf=2097152
> > net.inet.ip.fastforwarding=1
> > net.inet.tcp.rfc1323=1
> > net.link.ether.inet.max_age=600
> > net.inet.tcp.msl=7500
> > net.inet.ip.fw.dyn_udp_lifetime=10
> > net.inet.ip.fw.dyn_buckets=1024
> >
> > And here's my /boot/loader.conf:
> >
> > kern.ipc.maxsockets="163840"
> > kern.maxusers="2048"
> >
> > Is there anythign I'm overlooking that would be causing the machine  
> > to lockup
> > like this?
> 
> Your settings are tuned so high that you may be running out of KVA  
> memory.  I bet the system would be happier if you let maxusers  
> autotune itself (and then maybe adjust it by a factor of 2 from  
> there), and if you reduced kern.maxfilesperproc to 2048 or less, and  
> reduced the TCP sendspace to 65K.
> 
> [ As a last resort, you might even try nixing the fastforwarding  
> option.  It's well-suited for your task, and you do want it on if it  
> is working right, but maybe try running without it for a test. ]
> 
> -- 
> -Chuck
> 
> 

I've tried without fast forwarding, I've tried without the TCP sendspace as well
as reducing it to 65K, I let maxusers auto tune itself and I've even tried uping
the KVA space.

I'm at a loss, what would be the ideal sysctl's/loader.conf for a router thats
doing a fair amount of traffic?