Re: Too many dynamic rules
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigAF310259FFEEC93B3F92E424
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
On 13/11/2012 03:23, Dan Nelson wrote:
> In the last episode (Nov 12), Darrel said:
>> Hello,
>>
>> Today I booted r242670 from the console and noticed an error. This
>> is one line from the end of dmesg:
>>
>> ipfw: ipfw_install_state: Too many dynamic rules
>>
>> The ruleset has always been dynamic and has no additional rules.
>> Search engines produced similar error messages, but no information
>> that seems to be the correct solution.
>>
>> I have a basically identical ruleset on fbsd91 and no error message.
>=20
> That means that the dynamic rules generated by the keep-state keyword h=
it
> the currently-confgured limit. If you get hit with a lot of random tra=
ffic
> that matches a keep-state rule, you'll get that message. It's not the =
rules
> themselves that cause this, it's the traffic.
>=20
> Run "sysctl net.inet.ip.fw.dyn_max net.inet.ip.fw.dyn_count" and compar=
e the
> two values. If count is near to dyn_max, you can simply raise dyn_max.=
=20
> It's a writeable sysctl. I set it to 65535 on my systems in
> /etc/sysctl.conf with no apparent ill effects.
I have huge problems with the default settings, and I beat them down
with the following:
net.inet.ip.fw.dyn_max=3D8192
net.inet.ip.fw.dyn_buckets=3D1024
net.inet.ip.fw.dyn_ack_lifetime=3D60
net.inet.tcp.fast_finwait2_recycle=3D1
I also add these, though I don't think they help this particular problem:=
net.inet.tcp.nolocaltimewait=3D1
net.inet.tcp.ecn.enable=3D1
--------------enigAF310259FFEEC93B3F92E424
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (FreeBSD)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAlCiWh4ACgkQ/QjVBj3/HSw0PwCgmnhA++xdPcKJo2OriIZVezT0
EGgAniXZHbwNHzWKUSss/eM4+BBBqEgO
=4DcX
-----END PGP SIGNATURE-----
--------------enigAF310259FFEEC93B3F92E424--
討論串 (同標題文章)