From owner-freebsd-ipfw@FreeBSD.ORG Wed Mar 7 21:47:24 2007 Return-Path: X-Original-To: freebsd-ipfw@freebsd.org Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 383A716A400 for ; Wed, 7 Mar 2007 21:47:24 +0000 (UTC) (envelope-from justin@sk1llz.net) Received: from sed.awknet.com (sed.awknet.com [66.152.175.11]) by mx1.freebsd.org (Postfix) with ESMTP id 20CF313C461 for ; Wed, 7 Mar 2007 21:47:24 +0000 (UTC) (envelope-from justin@sk1llz.net) Received: by sed.awknet.com (Postfix, from userid 58) id E9A7B10BBE5B; Wed, 7 Mar 2007 13:47:23 -0800 (PST) X-Spam-Checker-Version: SpamAssassin 3.1.3 (2006-06-01) on sed.awknet.com X-Spam-Level: X-Spam-Status: No, score=-99.5 required=5.0 tests=AWL,BAYES_50, USER_IN_WHITELIST autolearn=disabled version=3.1.3 Received: from [192.168.1.102] (cpe-76-167-105-254.socal.res.rr.com [76.167.105.254]) by sed.awknet.com (Postfix) with ESMTP id B039010BBD3F; Wed, 7 Mar 2007 13:47:21 -0800 (PST) Message-ID: <45EF32E2.8000807@sk1llz.net> Date: Wed, 07 Mar 2007 13:47:14 -0800 From: Justin Robertson User-Agent: Thunderbird 1.5.0.10 (Windows/20070221) MIME-Version: 1.0 To: Chuck Swiger References: <000301c760fa$df57eb40$9e07c1c0$@net> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: freebsd-ipfw@freebsd.org Subject: Re: IPFW SACK options X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Mar 2007 21:47:24 -0000 Chuck Swiger wrote: > On Mar 7, 2007, at 12:54 PM, Justin Robertson wrote: > [ ... ] >> Due to the nature of the current performance disparity between 6.x (I >> assume this is due to the work on making processes thread friendly?) and >> 4.11 (still kicking arse) I'm sticking with the 4.11 branch - and >> here comes >> my question. If someone is interested, could you work up an option to >> allow >> removal of the sackOK (sack permitted negotiation) on SYN packets, >> and then >> pass the SYN packet on with the tcpoption for sack stripped? > > Perhaps trying: > > sysctl net.inet.tcp.sack.enable=0 > > ...will do what you are looking for? > > ---Chuck > > No (this only works in 6.x, btw) - setting sack.enable=0 simply tells the system not to send selective acks itself, this doesn't stop a host from sending selective acks inbound, and processing them still causes the system to bog and die. What I'm looking for here, is a patch to ipfw to allow one to set a flag to strip the tcpoption sack from syn packets. -- Justin