[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: pps or other unknown upper bound?



On Thu, Nov 17, 2005 at 04:03:25AM -0600, Kevin wrote:
> On 11/16/05, Jon Hart <[email protected]> wrote:
> > pass in on $CLIENT_IF inet proto tcp from $CLIENT_NET to $SERVER_NET \
> >   port 12345 flags S/SA modulate state
> 
> I know it's a stupid question, but have you tried the same ruleset,
> but not modulating state?  How about the same rules, with pass in/out
> rules and no:"keep state"?
I haven't tried with something other than modulate state, but I'll give
it a shot.  As far as not keeping state, I'm not sure that'll help
because then the packets may be denied going in/out on the other
interface.
> > Any input, whether its pf, OpenBSD or
> > client related would be much appreciated.
> 
> While running similar tests (httperf or http_load) with large numbers
> of TCP sessions where the client and the server are running OpenBSD,
> I've run into issues which appear to be related to filling up the
> local host (not pf) TCP state table with   TIME_WAIT entries on the
> client, the server, or both.
> 
> This can be diagnosed by running "netstat -np tcp" on the
> client/server, right when the problem starts.
Thats the odd part.  When the firewall is involved, netstat on the
client tops out at around, oh, 400 or so in TIME_WAIT.  Without the
firewall, there are thousands in TIME_WAIT and this mysterious 45s
timeout does not exist.
Thanks!
-jon