From owner-freebsd-pf@freebsd.org  Mon Jun 29 10:46:22 2015
Return-Path: <owner-freebsd-pf@freebsd.org>
Delivered-To: freebsd-pf@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2A11D98F3F2
 for <freebsd-pf@mailman.ysv.freebsd.org>; Mon, 29 Jun 2015 10:46:22 +0000 (UTC)
 (envelope-from dhartmei@insomnia.benzedrine.ch)
Received: from insomnia.benzedrine.ch
 (106.30.3.213.static.wline.lns.sme.cust.swisscom.ch [213.3.30.106])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client CN "insomnia.benzedrine.ch",
 Issuer "StartCom Class 1 Primary Intermediate Server CA" (not verified))
 by mx1.freebsd.org (Postfix) with ESMTPS id B305F1DB0
 for <freebsd-pf@freebsd.org>; Mon, 29 Jun 2015 10:46:20 +0000 (UTC)
 (envelope-from dhartmei@insomnia.benzedrine.ch)
Received: from insomnia.benzedrine.ch (localhost [127.0.0.1])
 by insomnia.benzedrine.ch (8.14.6/8.14.6) with ESMTP id t5TAkE5J021579
 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO);
 Mon, 29 Jun 2015 12:46:14 +0200 (MEST)
Received: (from dhartmei@localhost)
 by insomnia.benzedrine.ch (8.14.6/8.14.5/Submit) id t5TAkET9015385;
 Mon, 29 Jun 2015 12:46:14 +0200 (MEST)
Date: Mon, 29 Jun 2015 12:46:14 +0200
From: Daniel Hartmeier <daniel@benzedrine.ch>
To: Milan Obuch <freebsd-pf@dino.sk>
Cc: Ian FREISLICH <ian.freislich@capeaugusta.com>, freebsd-pf@freebsd.org
Subject: Re: Large scale NAT with PF - some weird problem
Message-ID: <20150629104614.GD22693@insomnia.benzedrine.ch>
References: <20150620182432.62797ec5@zeta.dino.sk>
 <20150619091857.304b707b@zeta.dino.sk>
 <14e119e8fa8.2755.abfb21602af57f30a7457738c46ad3ae@capeaugusta.com>
 <E1Z6dHz-0000uu-D8@clue.co.za>
 <20150621133236.75a4d86d@zeta.dino.sk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20150621133236.75a4d86d@zeta.dino.sk>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-BeenThere: freebsd-pf@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Technical discussion and general questions about packet filter
 \(pf\)" <freebsd-pf.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-pf/>
List-Post: <mailto:freebsd-pf@freebsd.org>
List-Help: <mailto:freebsd-pf-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-pf>,
 <mailto:freebsd-pf-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 29 Jun 2015 10:46:22 -0000

On Sun, Jun 21, 2015 at 01:32:36PM +0200, Milan Obuch wrote:

> One observation, on pfctl -vs info output - when src-limit counters
> rises to 30 or so, I am getting first messages someone has problem. Is
> it only coincidence or is there really some relation to my problem?

This might be a clue. That counter shouldn't increase. It means
something triggered a PFRES_SRCLIMIT.

Are you using source tracking for anything else besides the NAT sticky
address feature?

If not, the only explanation for a PFRES_SRCLIMIT in a translation rule
is a failure of pf.c pf_insert_src_node(), which could only be an
allocation failure with uma_zalloc().

Do you see any allocation failures? Log entries about uma, "source nodes
limit reached"? How about vmstat -m?

Daniel