On Fri, Apr 27, 2007 at 04:45:03PM -0500, Peter Eisch wrote:
> Oddly I'm not too concerned about actually fixing the system ...

I would simply turn off "FAST_IPSEC" in the kernel configuration. Unless
you have a hardware crypto accelerator or your system has to deal with
high bandwith with little CPU power the KAME IPsec stack will work just
fine for your.

> Is there a way to be able to track from userland whatever buffer is getting
> exhausted?

"netstat -m" will tell you how many mbuf-s are used in the kernel.

	Kind regards

-- 
Matthias Scheler                                  http://zhadum.org.uk/