Date: Mon, 29 Jun 2015 12:46:14 +0200 From: Daniel Hartmeier <daniel@benzedrine.ch> To: Milan Obuch <freebsd-pf@dino.sk> Cc: Ian FREISLICH <ian.freislich@capeaugusta.com>, freebsd-pf@freebsd.org Subject: Re: Large scale NAT with PF - some weird problem Message-ID: <20150629104614.GD22693@insomnia.benzedrine.ch> In-Reply-To: <20150621133236.75a4d86d@zeta.dino.sk> References: <20150620182432.62797ec5@zeta.dino.sk> <20150619091857.304b707b@zeta.dino.sk> <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com> <E1Z6dHz-0000uu-D8@clue.co.za> <20150621133236.75a4d86d@zeta.dino.sk>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jun 21, 2015 at 01:32:36PM +0200, Milan Obuch wrote: > One observation, on pfctl -vs info output - when src-limit counters > rises to 30 or so, I am getting first messages someone has problem. Is > it only coincidence or is there really some relation to my problem? This might be a clue. That counter shouldn't increase. It means something triggered a PFRES_SRCLIMIT. Are you using source tracking for anything else besides the NAT sticky address feature? If not, the only explanation for a PFRES_SRCLIMIT in a translation rule is a failure of pf.c pf_insert_src_node(), which could only be an allocation failure with uma_zalloc(). Do you see any allocation failures? Log entries about uma, "source nodes limit reached"? How about vmstat -m? Daniel
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20150629104614.GD22693>