From owner-freebsd-stable@FreeBSD.ORG Tue Sep 14 11:03:05 2010 Return-Path: Delivered-To: stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id DD042106566B for ; Tue, 14 Sep 2010 11:03:05 +0000 (UTC) (envelope-from jdc@koitsu.dyndns.org) Received: from qmta09.westchester.pa.mail.comcast.net (qmta09.westchester.pa.mail.comcast.net [76.96.62.96]) by mx1.freebsd.org (Postfix) with ESMTP id 8A2578FC14 for ; Tue, 14 Sep 2010 11:03:05 +0000 (UTC) Received: from omta15.westchester.pa.mail.comcast.net ([76.96.62.87]) by qmta09.westchester.pa.mail.comcast.net with comcast id 6acl1f0021swQuc59b352N; Tue, 14 Sep 2010 11:03:05 +0000 Received: from koitsu.dyndns.org ([98.248.41.155]) by omta15.westchester.pa.mail.comcast.net with comcast id 6b331f00E3LrwQ23bb3441; Tue, 14 Sep 2010 11:03:05 +0000 Received: by icarus.home.lan (Postfix, from userid 1000) id 5EE459B423; Tue, 14 Sep 2010 04:03:02 -0700 (PDT) Date: Tue, 14 Sep 2010 04:03:02 -0700 From: Jeremy Chadwick To: Gareth de Vaux Message-ID: <20100914110302.GA84971@icarus.home.lan> References: <20100909153902.GA28341@lordcow.org> <20100909162009.GA80375@icarus.home.lan> <20100910114908.GA55978@lordcow.org> <20100914103657.GA57521@lordcow.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20100914103657.GA57521@lordcow.org> User-Agent: Mutt/1.5.20 (2009-06-14) Cc: stable@freebsd.org Subject: Re: ipfw: Too many dynamic rules X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Sep 2010 11:03:05 -0000 On Tue, Sep 14, 2010 at 12:36:57PM +0200, Gareth de Vaux wrote: > On Fri 2010-09-10 (13:49), Gareth de Vaux wrote: > > > Thirdly, if you feel FIN_WAIT2 is the cause of your problem, then you > > > should consider adjusting the following sysctl: > > > > > > net.inet.tcp.finwait2_timeout > > > > > > Try something like 15000 (15 seconds) instead of the default (60000). > > > > Ok that seems to be doing something. Will report back later. > > Nope it's not helping. That and/or dropping net.inet.ip.fw.dyn_ack_lifetime. You're absolutely certain these are all in FIN_WAIT_2 state and not TIME_WAIT? -- | Jeremy Chadwick jdc@parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB |