ipfw: Too many dynamic rules
Jeremy Chadwick
freebsd at jdc.parodius.com
Tue Sep 14 11:30:56 UTC 2010
On Tue, Sep 14, 2010 at 01:12:00PM +0200, Gareth de Vaux wrote:
> On Tue 2010-09-14 (04:03), Jeremy Chadwick wrote:
> > You're absolutely certain these are all in FIN_WAIT_2 state and not
> > TIME_WAIT?
>
> Yup,
>
> $ netstat -an | grep FIN_WAIT_1 | wc -l
> 57
> $ netstat -an | grep FIN_WAIT_2 | wc -l
> 431
> $ netstat -an | grep TIME_WAIT | wc -l
> 17
Regarding net.inet.tcp.finwait2_timeout=15000 -- you don't see any
improvement at all? That's a bit strange. There's probably something
about ipfw I'm not getting. Adding luigi@ to the CC list, since I think
he's familiar with ipfw internals.
FWIW, I'd recommend keeping an appended log of output from something
like this script:
while true
do
echo "`date` -- `netstat -n | grep -c FIN_WAIT_2`" >> /some/log
sleep 5
done
Just make sure the sleep interval is lower than the FIN timeout.
Another thing to try: setting net.inet.tcp.fast_finwait2_recycle=1 and
see if this makes a difference. I'm not familiar with this setting
myself, but some Google results indicate some people do use it. The
sysctl description is a bit vague too.
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
More information about the freebsd-stable
mailing list