[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pfctl: Cannot allocate memory
Greg Wooledge wrote:
Cedric Berger ([email protected]) wrote:Ok, I'm 99% convinced this has nothing to do with PF.
Here is the problem I think: 40MB of kernel memory for routing table
entries...Whenever I notice a new IP address that needs my attention. Unfortunately
It might be PF table stuff..., not sure yet.
Do you reload your "ban" table very often?
this can often be several times in an evening.
At the time I sent my last e-mail, the box had been up approximately
two weeks, so I figured I'd upgrade CVS before rebooting it. I did
that, and now my 3.5-beta -current box has been up 22 hours.
"netstat -rn | wc" shows 79 lines. Here's the top section (before the
IPv6 stuff, which I don't use, as far as I know).
Destination Gateway Flags Refs Use Mtu Interface
default 220.127.116.11 UGS 470 4603644 1492 tun0
18.104.22.168 22.214.171.124 UGHD 0 4600038 1492 L tun0
126.96.36.199 188.8.131.52 UGHD 1 4603283 1492 L tun0
184.108.40.206 220.127.116.11 UGHD 0 4602201 1492 L tun0
18.104.22.168 22.214.171.124 UGHD 1 4575857 1492 L tun0
126.96.36.199 188.8.131.52 UGHD 1 4586241 1492 L tun0
184.108.40.206 220.127.116.11 UGHD 1 4595161 1492 L tun0
18.104.22.168 22.214.171.124 UGHD 1 4594391 1492 L tun0
If the routing table really does grow every time some spammer or P2PWe're looking at the problem, but there is very likely a bug related to
user connects to me from the Internet, and never gets pruned, then
this resembles a denial of service attack. :-/ But I have a hard time
believing I'd be the only person seeing such a problem.
You can probably workaround the problem by turning PMTU off with sysctl:
vm34c# grep mtu sysctl.conf
#net.inet.ip.mtudisc=0 # 0=disable tcp mtu discovery
I don't know if that is possible for you, though.