kernel: drop session, too many entries

From: Claus Rasmussen (none@claus--webclaus.com.lh.bsd-dk.dk)
Date: Wed 23 Mar 2005 - 12:19:47 CET

Next message: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Previous message: Fedder Skovgaard: "Re: BSD-DK Fødselsdag på Fyn?"
Next in thread: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Reply: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Mail actions: [ respond to this message ] [ mail a new topic ]

Date: Wed, 23 Mar 2005 12:19:47 +0100 (CET)
Subject: kernel: drop session, too many entries
From: "Claus Rasmussen" <none@claus--webclaus.com.lh.bsd-dk.dk>
To: bsd-dk@bsd-dk.dk

Halløj,

Min /var/log/security på en 5.3-RELEASE-p5 flyder over med beskedder som subj.

Jeg kører en stateful firewall som er skåret efter instruktionerne på
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-ipfw.html.

Serveren kører hovedsagligt www og mail. Folk klager fra tid til anden over
at de får timeouts når de prøver at tilgå boksen.

Har Googlet og fundet, at fejlmeddelelsen skulle skyldes at der er for mange
dynamiske regler, men jeg kommer aldrig i nærheden af max:

# sysctl -a | grep net.inet.ip.fw
net.inet.ip.fw.enable: 1
net.inet.ip.fw.autoinc_step: 100
net.inet.ip.fw.one_pass: 1
net.inet.ip.fw.debug: 1
net.inet.ip.fw.verbose: 1
net.inet.ip.fw.verbose_limit: 100
net.inet.ip.fw.dyn_buckets: 256
net.inet.ip.fw.curr_dyn_buckets: 256
net.inet.ip.fw.dyn_count: 333 <------------------
net.inet.ip.fw.dyn_max: 4096 <-------------------
net.inet.ip.fw.static_count: 47
net.inet.ip.fw.dyn_ack_lifetime: 300
net.inet.ip.fw.dyn_syn_lifetime: 20
net.inet.ip.fw.dyn_fin_lifetime: 1
net.inet.ip.fw.dyn_rst_lifetime: 1
net.inet.ip.fw.dyn_udp_lifetime: 10
net.inet.ip.fw.dyn_short_lifetime: 5
net.inet.ip.fw.dyn_keepalive: 1

Ved ikke rigtig hvor jeg skal tage fat. Nogen der har et tip?

/claus

Next message: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Previous message: Fedder Skovgaard: "Re: BSD-DK Fødselsdag på Fyn?"
Next in thread: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Reply: Flemming Jacobsen: "Re: kernel: drop session, too many entries"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Mail actions: [ respond to this message ] [ mail a new topic ]

This archive was generated by hypermail 2b30 : Wed 15 Nov 2006 - 18:24:49 CET