From owner-freebsd-hackers@FreeBSD.ORG  Sun Jan  4 17:40:23 2004
Return-Path: <owner-freebsd-hackers@FreeBSD.ORG>
Delivered-To: freebsd-hackers@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 3FC4416A4CE
	for <freebsd-hackers@freebsd.org>;
	Sun,  4 Jan 2004 17:40:23 -0800 (PST)
Received: from ussenterprise.ufp.org (ussenterprise.ufp.org [208.185.30.210])
	by mx1.FreeBSD.org (Postfix) with ESMTP id E65F643D31
	for <freebsd-hackers@freebsd.org>;
	Sun,  4 Jan 2004 17:40:21 -0800 (PST)
	(envelope-from bicknell@ussenterprise.ufp.org)
Received: from ussenterprise.ufp.org (bicknell@localhost [127.0.0.1])
	by ussenterprise.ufp.org (8.12.9/8.12.9) with ESMTP id i051eL2x010896
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
	for <freebsd-hackers@freebsd.org>;
	Sun, 4 Jan 2004 20:40:21 -0500 (EST)
Received: (from bicknell@localhost)
	by ussenterprise.ufp.org (8.12.9/8.12.9/Submit) id i051eLI4010895
	for freebsd-hackers@freebsd.org; Sun, 4 Jan 2004 20:40:21 -0500 (EST)
Date: Sun, 4 Jan 2004 20:40:21 -0500
From: Leo Bicknell <bicknell@ufp.org>
To: freebsd-hackers@freebsd.org
Message-ID: <20040105014021.GA10653@ussenterprise.ufp.org>
Mail-Followup-To: freebsd-hackers@freebsd.org
References: <6.0.1.1.2.20040104165741.029d6940@202.179.0.80>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="uAKRQypu60I7Lcqm"
Content-Disposition: inline
In-Reply-To: <6.0.1.1.2.20040104165741.029d6940@202.179.0.80>
Organization: United Federation of Planets
X-PGP-Key: http://www.ufp.org/~bicknell/
Subject: Re: ipfw2 problem
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
	<freebsd-hackers.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-hackers>,
	<mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 05 Jan 2004 01:40:23 -0000


--uAKRQypu60I7Lcqm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

In a message written on Sun, Jan 04, 2004 at 05:32:17PM +0800, Ganbold wrot=
e:
> me what will happen when  net.inet.ip.fw.dyn_count reaches=20
> net.inet.ip.fw.dyn_max value?

As a random passing thought...

Anytime a new dynamic rule is denied due to reaching dyn_max, a new
counter, eg, "dropped_dyn_rules" should be incremented, so the user
can at least verify the limit is the problem.

--=20
       Leo Bicknell - bicknell@ufp.org - CCIE 3440
        PGP keys at http://www.ufp.org/~bicknell/
Read TMBG List - tmbg-list-request@tmbg.org, www.tmbg.org

--uAKRQypu60I7Lcqm
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (FreeBSD)

iD8DBQE/+MCFNh6mMG5yMTYRApbuAJ98eJNMMR8yYX0dMm9A8WCBXO6fRQCeMrlI
YkxHTR4LjIRdvxF8S3Yst8I=
=A8vt
-----END PGP SIGNATURE-----

--uAKRQypu60I7Lcqm--