>  So I upgraded my nat box / firewall to -current because I
>wanted to play with IPSEC and test the new ipf code when it
>comes out.
>  With the result that I now have a machine that goes comatose
>once a day, usually running out of mbufs (sendto: no buffer space
>available) or being generally unresponsive (telnet connects, then
>nothing happens; not even login on console possible).
>  I suspect it's a weird interaction between ipf and ipsec,
>or perhaps ipsec without ipv6, something like that. 
>  My question is now, what to do to trace that down? Just filing
>a PR with "my machine wedges after a day" is a bit on the thin
>side. I'm just compiling a kernel with DIAGNOSTICS and DDB, so
>what should I do when the machine runs out of buf space? What
>should I do when it wedges?

	how about taking vmstat -m to see if there's anybody taking too much?

itojun