From owner-freebsd-questions@FreeBSD.ORG Wed Mar 16 04:54:34 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CAA0D16A4CE for ; Wed, 16 Mar 2005 04:54:34 +0000 (GMT) Received: from mail.el.net (mail.el.net [68.165.89.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id 426F543D41 for ; Wed, 16 Mar 2005 04:54:34 +0000 (GMT) (envelope-from kalin@el.net) Received: (qmail 95867 invoked by uid 1008); 16 Mar 2005 04:54:44 -0000 Received: from unknown (HELO mail.el.net) (127.0.0.1) by mail.el.net with SMTP; 16 Mar 2005 04:54:44 -0000 Received: from 68.165.89.73 (SquirrelMail authenticated user kalin@el.net); by mail.el.net with HTTP; Tue, 15 Mar 2005 23:54:44 -0500 (EST) Message-ID: <53058.68.165.89.73.1110948884.squirrel@68.165.89.73> In-Reply-To: <1110945574l.25764l.2l@BARTON> References: <52214.68.165.89.73.1110927742.squirrel@68.165.89.73> <1110945574l.25764l.2l@BARTON> Date: Tue, 15 Mar 2005 23:54:44 -0500 (EST) From: "kalin mintchev" To: "Jason Henson" User-Agent: SquirrelMail/1.4.3a X-Mailer: SquirrelMail/1.4.3a MIME-Version: 1.0 Content-Type: text/plain;charset=iso-8859-1 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) Importance: Normal cc: freebsd-questions@freebsd.org Subject: Re: kern.ipc.nmbclusters X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Mar 2005 04:54:34 -0000 > Did you check top to see if you even use swap? yea. very small amount. Swap: 2032M Total, 624K Used, 2031M Free > I never use swap with > 512MB on my desktop. Read man tuning, around byte 32372. i did a few times. don't remember which byte was it thought... > Try netstat > -m. i did. here: this was when i send this message originally: # netstat -m 6138/6832/26624 mbufs in use (current/peak/max): 6137 mbufs allocated to data 1 mbufs allocated to fragment reassembly queue headers 6092/6656/6656 mbuf clusters in use (current/peak/max) 15020 Kbytes allocated to network (75% of mb_map in use) 11125 requests for memory denied 1 requests for memory delayed 0 calls to protocol drain routines =================================== this is now: netstat -m 349/6832/26624 mbufs in use (current/peak/max): 348 mbufs allocated to data 1 mbufs allocated to fragment reassembly queue headers 346/6656/6656 mbuf clusters in use (current/peak/max) 15020 Kbytes allocated to network (75% of mb_map in use) 11125 requests for memory denied 1 requests for memory delayed 0 calls to protocol drain routines huge difference. so i think about 260 lines of netstat -p tcp output like: tcp4 0 33580 server.http c68.112.166.214..3307 FIN_WAIT_1 has to do with all these 6000 clusters. but i'm not sure how. DOS may be?! they are all from the same client ip and all of them have much higher number for send then received Q's. what does the state FIN_WAIT_1 mean? waiting to finish? if so - why it didn't do that for hours and hours. my web server keeps connections alive for 10 sec. there isn't much else that uses tcp on that machine. the webserver was inaccessile for about 5-10 min. so my first thought was DOS... "11125 requests for memory denied" made it look like it was a DOS... maybe somebody can explain the relation if any. it'll be appreciated... thanks.... > > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to > "freebsd-questions-unsubscribe@freebsd.org" > --