Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 10 Sep 2004 13:35:13 -0500
From:      Patrick <patrick@esoltani.com>
To:        Ben Bentsen <freebsd@usww.com>
Cc:        freebsd-ipfw@freebsd.org
Subject:   Re: kernel: ipfw: install_state: Too many dynamic rules
Message-ID:  <4141F3E1.3070906@esoltani.com>
In-Reply-To: <4141F8E0.8060700@usww.com>
References:  <4141F8E0.8060700@usww.com>

next in thread | previous in thread | raw e-mail | index | archive | help
Ben Bentsen wrote:

> Hello group,
> 
> Can any shed a little light on the following error messages. I have 
> spent a great deal of time looking at what is running at about 
> 9:30am-9:45am and have found nothing that I can pin to these errors. No 
> cron jobs are running anywhere even close to the time. TCPdump does not 
> shed any light either. This machine has only one purpose to pass, count, 
> limit and deny packets to a network Only SSH and FTP services are 
> enabled on this machine. What conditions case this message maybe I am 
> looking in the wrong place.
> 
> INET ----  This Machine ---  Catalyst 2820 ------ 14 computer units
> 
> Aug  7 09:41:34 7206 /kernel: ipfw: install_state: Too many dynamic rules
> Aug 10 09:41:207206 /kernel: ipfw: install_state: Too many dynamic rules
> Aug 13 09:41:31 7206 /kernel: ipfw: install_state: Too many dynamic rules

You see these because you have most of your rules setup to utilize the 
keep-state stuff (stateful thingy).

couple of things you can do:

#sysctl -a | grep bucket
net.inet.ip.fw.dyn_buckets: 256

which is default, at least on 5.2.1, should be the same on 4.x
increasing this will require more memory, but should give *some* relief.

make an explicit rule for outgoing packets.

Regards,
Patrick Soltani.



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4141F3E1.3070906>