From owner-freebsd-questions@FreeBSD.ORG Sun Jan 9 00:33:17 2005 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id CB37D16A4CE for ; Sun, 9 Jan 2005 00:33:17 +0000 (GMT) Received: from fledge.watson.org (fledge.watson.org [204.156.12.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 69DF043D1D for ; Sun, 9 Jan 2005 00:33:17 +0000 (GMT) (envelope-from robert@fledge.watson.org) Received: from fledge.watson.org (localhost [127.0.0.1]) by fledge.watson.org (8.13.1/8.13.1) with ESMTP id j090TPSa051725; Sat, 8 Jan 2005 19:29:25 -0500 (EST) (envelope-from robert@fledge.watson.org) Received: from localhost (robert@localhost)j090TPpY051722; Sun, 9 Jan 2005 00:29:25 GMT (envelope-from robert@fledge.watson.org) Date: Sun, 9 Jan 2005 00:29:25 +0000 (GMT) From: Robert Watson X-Sender: robert@fledge.watson.org To: Jay Teutenberg In-Reply-To: <005901c4f5c9$dc817600$a2a6b0d8@right> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII cc: freebsd-questions@freebsd.org Subject: Re: 5.x can ping 25152 bytes but not 25153 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Jan 2005 00:33:17 -0000 On Sat, 8 Jan 2005, Jay Teutenberg wrote: > We are up against an interesting problem. > > We have several FBSD servers, the ones that are 5.x do not seem to be > able to respond to pings larger than 25152, but 4.x kernels can. > > We are getting I/O errors from sendmail and want to make sure our > networking is ok. We have tried swapping cables, ports in the cisco cat > 2912, swapped 3com905's, no luck. > > Thanks all, my apologies if this is a bikeshed, I did my best to > research it. Found some postings in this group last year where someone > mentions this phenomena, but no fix or answer was offered. > http://lists.freebsd.org/pipermail/freebsd-questions/2004-April/044070.html This is probably due to resource limits on the maximum number of fragments that may be supported for an IP packet. You can take a look at the fragment limits using sysctl: net.inet.ip.maxfragpackets: 800 net.inet.ip.maxfragsperpacket: 16 If you increase maxfragsperpacket, you should be able to see FreeBSD clients and servers handle ICMP pings larger in size. These resources limits were put in place to address a widely observed denial of service attack involving the delivery of many small fragments to hosts in a form that prevents reassembly but consumes large amounts of memory and CPU. Let me know if tweaking the above doesn't help, though! Thanks, Robert N M Watson