From owner-freebsd-net@FreeBSD.ORG Sat Nov 10 09:37:16 2007 Return-Path: Delivered-To: net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 76E3716A41B for ; Sat, 10 Nov 2007 09:37:16 +0000 (UTC) (envelope-from silby@silby.com) Received: from relay03.pair.com (relay03.pair.com [209.68.5.17]) by mx1.freebsd.org (Postfix) with SMTP id 2B47413C4A8 for ; Sat, 10 Nov 2007 09:37:16 +0000 (UTC) (envelope-from silby@silby.com) Received: (qmail 74375 invoked from network); 10 Nov 2007 09:36:58 -0000 Received: from unknown (HELO localhost) (unknown) by unknown with SMTP; 10 Nov 2007 09:36:58 -0000 X-pair-Authenticated: 209.68.2.70 Date: Sat, 10 Nov 2007 03:36:57 -0600 (CST) From: Mike Silbersack To: Matt Reimer In-Reply-To: <20071110020333.I46803@odysseus.silby.com> Message-ID: <20071110033031.B46803@odysseus.silby.com> References: <20071109213846.O46803@odysseus.silby.com> <20071110020333.I46803@odysseus.silby.com> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: net@freebsd.org Subject: Re: Should syncache.count ever be negative? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 10 Nov 2007 09:37:16 -0000 On Sat, 10 Nov 2007, Mike Silbersack wrote: > FWIW, my crazy theory of the moment is this: We have some bug that happens > when the listen queues overflow in 7.0, and your test is strenuous enough to > hit the listen queue overflow condition, leading to total collapse. I'll > have to cobble together a test program to see what happens in the listen > queue overflow case. Post testing, I have a different theory. Can you also try sysctl net.inet.tcp.syncookies=0 I modified netrate's httpd to sleep a lot and found an interesting behavior between listen queue overflows and syncookies: 04:28:21.470931 IP 10.1.1.8.50566 > 10.1.1.6.http: S 287310302:287310302(0) win 32768 04:28:21.470939 IP 10.1.1.6.http > 10.1.1.8.50566: S 4209413098:4209413098(0) ack 287310303 win 65535 04:28:21.473487 IP 10.1.1.8.50566 > 10.1.1.6.http: . ack 1 win 33304 04:28:21.473493 IP 10.1.1.6.http > 10.1.1.8.50566: R 4209413099:4209413099(0) win 0 04:28:21.473642 IP 10.1.1.8.50566 > 10.1.1.6.http: P 1:78(77) ack 1 win 33304 04:28:21.482555 IP 10.1.1.6.http > 10.1.1.8.50566: P 1:126(125) ack 78 win 8326 04:28:21.482563 IP 10.1.1.6.http > 10.1.1.8.50566: F 126:126(0) ack 78 win 8326 04:28:21.487047 IP 10.1.1.8.50566 > 10.1.1.6.http: R 287310380:287310380(0) win 0 04:28:21.487398 IP 10.1.1.8.50566 > 10.1.1.6.http: R 287310380:287310380(0) win 0 The listen queue overflow causes the socket to be closed and a RST sent, but the next packet from 10.1.1.8 crosses it on the wire and activates the syncookie code, reopening the connection. Meanwhile, the RST arrives at 10.1.1.8 and closes its socket, leading to it sending RSTs when the data from 10.1.1.6 arrives. Not sure if that's your problem or not, but it's interesting. -Mike