[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: PF Problems
Thanks for responding. I will start watching this.
I am using NAT with <100 hosts. Most of the traffic is https.
NetBSD 4.0 amd64, 2 cpu, 1G memory
State Table Total Rate
current entries 4410
searches 7162532 270.3/s
inserts 357457 13.5/s
removals 353047 13.3/s
match 364479 13.8/s
bad-offset 0 0.0/s
fragment 0 0.0/s
short 0 0.0/s
normalize 0 0.0/s
memory 0 0.0/s
bad-timestamp 0 0.0/s
congestion 0 0.0/s
ip-option 0 0.0/s
proto-cksum 0 0.0/s
state-mismatch 6407 0.2/s
state-insert 0 0.0/s
state-limit 0 0.0/s
src-limit 0 0.0/s
synproxy 0 0.0/s
adaptive.start 0 states
adaptive.end 0 states
states hard limit 10000
src-nodes hard limit 10000
frags hard limit 5000
Patrick Welche wrote:
On Thu, Jul 16, 2009 at 09:32:55PM -0500, Steve Pribyl wrote:
I am using NetBSD 4.0 with Carp and pf.
The problem is pf works great for a while then starts to not work,
slow, refuses pings, forwarding, etc in a random way.
So, I need so suggestions on how to debug this or even if someone
has seen or heard of this before.
Roughly how many hosts have you got on your network? Are you using
network address translation?
Just guessing: many many connections all holding state, state table becomes
full so no more new connections allowed through. Some connection finishes,
so now there is room for a new one, so "randomly" works again...
pfctl -s all
Should show what is going on... My impression though is that defaults are
fine for hundreds of hosts, so check through your rules?
Main Index |
Thread Index |