From owner-freebsd-pf@FreeBSD.ORG  Fri Dec 16 19:48:08 2005
Return-Path: <owner-freebsd-pf@FreeBSD.ORG>
X-Original-To: freebsd-pf@freebsd.org
Delivered-To: freebsd-pf@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 9023E16A41F
	for <freebsd-pf@freebsd.org>; Fri, 16 Dec 2005 19:48:08 +0000 (GMT)
	(envelope-from dokas@oitsec.umn.edu)
Received: from mail.oitsec.umn.edu (mail.oitsec.umn.edu [128.101.238.120])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 6528743D7C
	for <freebsd-pf@freebsd.org>; Fri, 16 Dec 2005 19:48:06 +0000 (GMT)
	(envelope-from dokas@oitsec.umn.edu)
Received: from localhost (localhost [127.0.0.1])
	by mail.oitsec.umn.edu (Postfix) with ESMTP id 4BECD1CC02F;
	Fri, 16 Dec 2005 13:48:00 -0600 (CST)
Received: from mail.oitsec.umn.edu ([127.0.0.1])
	by localhost (mail.oitsec.umn.edu [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id 74627-04; Fri, 16 Dec 2005 13:47:59 -0600 (CST)
Received: from shoggoth.oitsec.umn.edu (shoggoth.oitsec.umn.edu
	[160.94.247.195])
	by mail.oitsec.umn.edu (Postfix) with ESMTP id E40791CC027;
	Fri, 16 Dec 2005 13:47:59 -0600 (CST)
Date: Fri, 16 Dec 2005 13:47:59 -0600
From: Paul Dokas <dokas@oitsec.umn.edu>
To: Daniel Hartmeier <daniel@benzedrine.cx>
Message-Id: <20051216134759.795206f3.dokas@oitsec.umn.edu>
In-Reply-To: <20051216193830.GC14269@insomnia.benzedrine.cx>
References: <20051216100915.73fef758.dokas@oitsec.umn.edu>
	<20051216183447.GA14269@insomnia.benzedrine.cx>
	<20051216190454.GF474@w4g.org>
	<20051216191831.GB14269@insomnia.benzedrine.cx>
	<20051216193830.GC14269@insomnia.benzedrine.cx>
Organization: OIT Security and Assurance, University of Minnesota
X-Mailer: Sylpheed version 2.0.4 (GTK+ 2.8.7; i386-portbld-freebsd6.0)
X-Discordia: fnord
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new at oitsec.umn.edu
Cc: frantzen@openbsd.org, freebsd-pf@freebsd.org
Subject: Re: very odd PF + FreeBSD6.0 problems
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: dokas@oitsec.umn.edu
List-Id: "Technical discussion and general questions about packet filter
	\(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
	<mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 16 Dec 2005 19:48:08 -0000

On Fri, 16 Dec 2005 20:38:30 +0100 Daniel Hartmeier <daniel@benzedrine.cx> wrote:
> Doh.
> 
> delta_tsval == 1424952994 - 1424712993 == 240001
> delta_time == 120082719 us (120.082719 s)
> 
> freq == delta_tsval / delta_time
>      == 240001 / 120.082719
>      == 240001 * 1000000 / 120082719   
>      == 1998 Hz (> 1000 Hz)
> 
> So it's not that far off, the server seems to increment timestamps at
> 0.5 ms per tick (2 kHz), instead of the RFC mandated 1 ms (1 kHz).
> 
> Daniel


Bingo (I think).  I found the following in the firewall's kernel config:

  options HZ=2000

I'm going to get than changed and see if the problem goes away.


I really appreciate the help!

Paul
-- 
Paul Dokas                                     dokas at oitsec.umn.edu
======================================================================
Don Juan Matus:  "an enigma wrapped in mystery wrapped in a tortilla."