From owner-freebsd-current@freebsd.org Fri May 20 14:31:27 2016 Return-Path: Delivered-To: freebsd-current@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id BD6F8B427CC for ; Fri, 20 May 2016 14:31:27 +0000 (UTC) (envelope-from zakharov.vv@gmail.com) Received: from mail-lb0-x236.google.com (mail-lb0-x236.google.com [IPv6:2a00:1450:4010:c04::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 41AB01157 for ; Fri, 20 May 2016 14:31:27 +0000 (UTC) (envelope-from zakharov.vv@gmail.com) Received: by mail-lb0-x236.google.com with SMTP id ww9so36007548lbc.2 for ; Fri, 20 May 2016 07:31:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=437x/jaNsfEnOK1QtosRqmszOBEhLgxYj591+dwxkqk=; b=R8ugC/5Jfju2sCGXMZQQCbEVyI/mkgar9zqRCQMwPf5T2bYKYZIE/gtvYIz/K0YBH5 pNjBSjCLQZJS8vt7vcv3DiDNswfOa21W7lFqKgpsdb+B70qbqjMFg/iiAhHzWKdvjrWE 2PT+US4J7EvCj70gUDdrCjtqmnJJpgewddTyKAwLczcAci4xlmVFICd8hcUSKOnK9Vfc S2K7Rumc0zsRUxcC4bUrVo8pEeHk1yAfmzXJsiXC1AFeo45Ixq6VXPGe59Mw1QYcw/WT 7/KnyxLz84sjtELYmSyDqjgJb9zTGfwMqBeBVcfNB6+C/4Ro8kOZ0ucQOdEyjPI0pjC8 uwJQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=437x/jaNsfEnOK1QtosRqmszOBEhLgxYj591+dwxkqk=; b=loe26KYKLqEWtHP+EDQ9UsDy626y08pqdkuBHif7rszCWXBCcTscHbF32ZinopEXkf SbezxJa190xw3bKUOWgH6iBzBBomnCE6sqC7HWNv4xzQUeFg4so4CaU/CwbPZRbR7mba bzUFWVU2XqawhEMAm/qHS3yfMFLDZg7jeCWd54Y37Pn2lXD15S+/VlYUmKVEjFdGgRiS GsLrkXE7Da1EsMW8wQc2mnhAOwx8jQ0CU1/zhNX4TP9sSAFXGlvqpKV2l5nOGlOqHbQ1 wC0/H39UIh7sAPBg3lOZE3cqiEl3hDFoQd8HldD4ohd8KjUKUNUl1chfvrl7KR0VuZnN AB5g== X-Gm-Message-State: AOPr4FWr0zhA9jO8gZQCRf95UMt53XJcLaLIeWx/yLjT/5VEpjuqM5bYmp87/lXd0NBdFg== X-Received: by 10.112.214.235 with SMTP id od11mr1235124lbc.21.1463754685375; Fri, 20 May 2016 07:31:25 -0700 (PDT) Received: from localhost ([81.19.73.103]) by smtp.gmail.com with ESMTPSA id pb3sm3277697lbb.37.2016.05.20.07.31.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 20 May 2016 07:31:24 -0700 (PDT) Date: Fri, 20 May 2016 17:31:24 +0300 From: Vladimir Zakharov To: Jan Bramkamp Cc: freebsd-current@freebsd.org Subject: Re: CURRENT: ipfw: problems with timeouts and worse network performance Message-ID: <20160520143124.GE2371@vzakharov> References: <20160520140152.3ab6fe44@hermann> <20160520125401.GC2371@vzakharov> <38888426-4d91-56ed-9ab3-0d516b0b8d46@rlwinm.de> <20160520135109.GD2371@vzakharov> <0429473a-6bb6-70cb-05ca-fe0e83c173a0@rlwinm.de> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <0429473a-6bb6-70cb-05ca-fe0e83c173a0@rlwinm.de> X-Operating-System: FreeBSD 11.0-CURRENT amd64 X-PGP-Key: http://vzakharov.ru/pubkey.asc User-Agent: Mutt/1.6.1 (2016-04-27) X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 May 2016 14:31:27 -0000 On Fri, May 20, 2016, Jan Bramkamp wrote: > On 20/05/16 15:51, Vladimir Zakharov wrote: > > On Fri, May 20, 2016, Jan Bramkamp wrote: > >> On 20/05/16 14:54, Vladimir Zakharov wrote: > >>> Hello > >>> > >>> On Fri, May 20, 2016, O. Hartmann wrote: > >>>> I reported earlier about broken pipes in ssh sessions to remote hosts, > >>>> which occur on an erratic basis. i'm investigating this problem now and > >>>> it seems that it is also ipfw-related, but I'm not sure. This problem > >>>> is present since a couple of weeks now. > >>> > >>> Maybe this could help... > >>> > >>> I've also experienced problems with broken pipes in ssh sessions some > >>> time ago. Setting in sysctl.conf > >>> > >>> net.inet.ip.fw.dyn_ack_lifetime=3600 > >>> > >>> fixed problem for me. I didn't experiment with the value though. So, > >>> possibly, changing default value (300s) to 1 hour is overkill :). > >> > >> By default the OpenSSH SSH client is configured to use TCP keepalives. > >> Those should produce enough packets at a short enough interval to keep > >> the dynamic IPFW state established. > >> > >> Does your traffic pass through libalias? > > I guess not. How can I be sure? > > Libalias is used by ipfw and the old userland natd to implement IPv4 > NAT. It requires unmodified access to all packets including their > headers. LRO and TSO coalesce packets to reduce save CPU time but the > process is loses some of the information required by libalias. Unless > your ruleset uses ipfw in-kernel NAT or diverts traffic to natd you > don't have to worry about libalias. > > Use `kldstat -v | grep libalias` to check for libalias in the running > kernel and `pgrep natd` to search for running natd instances. Surely, I do not use NAT (and libalias): root@vzakharov:~ # kldstat -v | grep libalias root@vzakharov:~ # pgrep natd I use GENERIC-NODEBUG kernel (r300138) with ipfw module. And 'workstation' firewall type. -- Regards, | "In theory there is no difference between theory Vladimir Zakharov | and practice. In practice there is."- Yogi Berra