From owner-freebsd-stable@FreeBSD.ORG  Wed Sep 15 14:24:28 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 9BC9110656EC;
	Wed, 15 Sep 2010 14:24:27 +0000 (UTC) (envelope-from bsd@lordcow.org)
Received: from lordcow.org (lordcow.org [41.203.5.188])
	by mx1.freebsd.org (Postfix) with ESMTP id 1C2788FC24;
	Wed, 15 Sep 2010 14:24:26 +0000 (UTC)
Received: from lordcow.org (localhost [127.0.0.1])
	by lordcow.org (8.14.4/8.14.4) with ESMTP id o8FENshn082829
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO);
	Wed, 15 Sep 2010 16:23:54 +0200 (SAST)
	(envelope-from lordcow@lordcow.org)
Received: (from lordcow@localhost)
	by lordcow.org (8.14.4/8.14.4/Submit) id o8FENmDk082827;
	Wed, 15 Sep 2010 16:23:48 +0200 (SAST) (envelope-from lordcow)
Date: Wed, 15 Sep 2010 16:23:47 +0200
From: Gareth de Vaux <bsd@lordcow.org>
To: stable@freebsd.org
Message-ID: <20100915142347.GA76805@lordcow.org>
References: <20100909153902.GA28341@lordcow.org>
	<20100909162009.GA80375@icarus.home.lan>
	<20100910114908.GA55978@lordcow.org>
	<20100914103657.GA57521@lordcow.org>
	<20100914110302.GA84971@icarus.home.lan>
	<20100914111200.GA59889@lordcow.org>
	<20100914113053.GA19053@icarus.home.lan>
	<20100914115438.GA61728@lordcow.org>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100914115438.GA61728@lordcow.org>
User-Agent: Mutt/1.4.2.3i
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
	autolearn=ham version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on lordcow.org
Cc: luigi@freebsd.org, Jeremy Chadwick <freebsd@jdc.parodius.com>
Subject: Re: ipfw: Too many dynamic rules
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 15 Sep 2010 14:24:28 -0000

On Tue 2010-09-14 (13:54), Gareth de Vaux wrote:
> On Tue 2010-09-14 (04:30), Jeremy Chadwick wrote:
> > Regarding net.inet.tcp.finwait2_timeout=15000 -- you don't see any
> > improvement at all?  That's a bit strange.  There's probably something
> 
> If there was an improvement it was subtle (I was doing sporadic
> measurements), just that in the end my firewall was getting overloaded
> either way.

Yeah looks like a bit of an improvement but I also wasn't controlling for
end user usage so can't say for sure without rerunning.

Setting net.inet.tcp.fast_finwait2_recycle=1 though seems to have done the
trick, thanx. This is now typical:

$ netstat -n | grep -c FIN_WAIT_2
5

and my server still seems to be serving.