From owner-freebsd-stable@FreeBSD.ORG  Fri Sep 10 11:49:23 2010
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: stable@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id CED5A1065694
	for <stable@freebsd.org>; Fri, 10 Sep 2010 11:49:23 +0000 (UTC)
	(envelope-from bsd@lordcow.org)
Received: from lordcow.org (lordcow.org [41.203.5.188])
	by mx1.freebsd.org (Postfix) with ESMTP id F2F078FC13
	for <stable@freebsd.org>; Fri, 10 Sep 2010 11:49:22 +0000 (UTC)
Received: from lordcow.org (localhost [127.0.0.1])
	by lordcow.org (8.14.4/8.14.4) with ESMTP id o8ABnEb6057228
	(version=TLSv1/SSLv3 cipher=DHE-DSS-AES256-SHA bits=256 verify=NO)
	for <stable@freebsd.org>; Fri, 10 Sep 2010 13:49:14 +0200 (SAST)
	(envelope-from lordcow@lordcow.org)
Received: (from lordcow@localhost)
	by lordcow.org (8.14.4/8.14.4/Submit) id o8ABn9lR057227
	for stable@freebsd.org; Fri, 10 Sep 2010 13:49:09 +0200 (SAST)
	(envelope-from lordcow)
Date: Fri, 10 Sep 2010 13:49:08 +0200
From: Gareth de Vaux <bsd@lordcow.org>
To: stable@freebsd.org
Message-ID: <20100910114908.GA55978@lordcow.org>
References: <20100909153902.GA28341@lordcow.org>
	<20100909162009.GA80375@icarus.home.lan>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20100909162009.GA80375@icarus.home.lan>
User-Agent: Mutt/1.4.2.3i
X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED
	autolearn=unavailable version=3.3.1
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on lordcow.org
Cc: 
Subject: Re: ipfw: Too many dynamic rules
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Production branch of FreeBSD source code <freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>, 
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Sep 2010 11:49:23 -0000

On Thu 2010-09-09 (09:20), Jeremy Chadwick wrote:
> Secondly, I'm fairly certain HTTP KeepAlive (re: KeepAliveTimeout) are
> unrelated to TCP keepalives[1].  I mention this because you're focusing
> on netstat, which will give you indication of TCP session state, not
> HTTP protocol statefulness. 

Gotcha

> Thirdly, if you feel FIN_WAIT2 is the cause of your problem, then you
> should consider adjusting the following sysctl:
> 
> net.inet.tcp.finwait2_timeout
> 
> Try something like 15000 (15 seconds) instead of the default (60000).

Ok that seems to be doing something. Will report back later.

> Finally, why are you using dynamic firewall rules at all?

So that I can identify legitimate(ish) traffic and drop the rest.

> For what purpose do you need these that, say, pf and its state
> tracking would not suffice?

I haven't used pf. I started with ipfw and its done the trick so far.
What's the difference between pf and ipfw's state tracking in this
respect?