On 4/28/07 5:50 AM, "Matthias Scheler" <tron@zhadum.org.uk> wrote:

> On Fri, Apr 27, 2007 at 04:45:03PM -0500, Peter Eisch wrote:
>> Oddly I'm not too concerned about actually fixing the system ...
> 
> I would simply turn off "FAST_IPSEC" in the kernel configuration. Unless
> you have a hardware crypto accelerator or your system has to deal with
> high bandwith with little CPU power the KAME IPsec stack will work just
> fine for your.
> 

I had to change from the KAME stack to the FAST_IPSEC when I changed from
netbsd-2-0 to netbsd-3-0 in order to keep the system working at all with one
of the peers.  You may recall that drama.

>> Is there a way to be able to track from userland whatever buffer is getting
>> exhausted?
> 
> "netstat -m" will tell you how many mbuf-s are used in the kernel.
> 

K, thanks.

peter