Res: Dropped Packets

PLEASE CORRECT ME IF I'M READING THIS INCORRECTLY. BUT IT
SOUNDS LIKE 
YOU'RE SAYING THE FIREWALLS WORKED FINE UNTIL YOU
IMPLEMENTED PFSYNC, IS 
THIS CORRECT?

YOU READ INCORRECLY,  EVERTYTHING IS OK WITH PFSYNC

IF SO TRY BACKING OUT OF THAT TO ISOLATE THAT CHANGE AND
CONFIRM THIS. 
I'VE SEEN PFSYNC PACKETS EITHER BY LOST OF "SLOW"
IN SYNCHRONIZING WITH 
THE OTHER FIREWALL AND AS A RESULT STATE MISMATCHING
OCCURRING ON THE 
SECONDARY FIREWALL (IF BOTH ARE ACTIVE - I.E. ARP BALANCE).
IF YOU'RE 
USING THAT TRY DISABLING IT AND SEE IF THERE IS AN
IMPROVEMENT.

ALSO, HAVE YOU MADE ANY MODIFICATIONS TO SYSCTL.CONF AND
LOADER.CONF? IF 
SO PLEASE POST THEM HERE.


EVERTHING WAS OK UNTIL WE START TOMAKE BACKUPS PASSING
THROUGH THE FIREWALL.  THE ONLY THING THAT ICHANGE AFTER THE
PROBLEM WAS:

ADD THIS LINE ON SYSCTL.CONF: 

NET.INET.IP.IFQ.MAXLEN=1024

BUT IT DIDN'T SOLVE THE PROBLEM.

 

LORENZ.



      ABRA SUA CONTA NO YAHOO! MAIL, O úNICO SEM LIMITE DE
ESPAçO PARA ARMAZENAMENTO!
HTTP://BR.MAIL.YAHOO.COM/
_______________________________________________
FREEBSD-PFFREEBSD.ORG MAILING LIST
HTTP://LISTS.FREEBSD.ORG/MAILMAN/LISTINFO/FREEBSD-PF
TO UNSUBSCRIBE, SEND ANY MAIL TO
"FREEBSD-PF-UNSUBSCRIBEFREEBSD.ORG"

Lorenz Helleis wrote:
> everthing was ok until we start tomake backups passing
through the firewall.  
What sort of 'backups', using what exactly ?

Did you monitor the input Q drop figure from

	net.inet.ip.intr_queue_drops

before during and after the service impacting traffic ?

Do you capture interface statistics using something like
Cacti ?

Some idea of packet forwarding rate, before during and after
would be 
useful.


Regards

Greg

_______________________________________________
freebsd-pffreebsd.org mailing list

http://lists.freebsd.org/mailman/listinfo/freebsd-pf
To unsubscribe, send any mail to
"freebsd-pf-unsubscribefreebsd.org"