On 2/14/03 3:19 PM, Beers, James W. wrote:
[...]
#ifpstat
IPv6 packets: in 0 out 0
input packets: blocked 5974413 passed 559087610 nomatch 0 counted 0
short 0
output packets: blocked 613 passed 279566564 nomatch 0 counted 0
short 0
input packets logged: blocked 3663591 passed 10052086
output packets logged: blocked 613 passed 300
packets logged: input 0 output 0
log failures: input 548071 output 37
You have a lot of log failures. You should increase IPLLOGSIZE in ip_fil.h.
[...]
This is after 5 days of uptime. Would you be willing to share the output
from your box? Just to fill in some gaps, I'm running version 3.4.31 on a
PIII, 256 MB RAM, 100MB FD internal/external connections using FreeBSD 4.5.
Our connection to the 'Net is 6MB. Right now only ipf is running on the
box.
# ipfstat
IPv6 packets: in 0 out 0
input packets: blocked 1110058 passed 143406322 nomatch 11431
counted 0 short 0
output packets: blocked 14563 passed 139328577 nomatch 1095
counted 0 short 0
input packets logged: blocked 413563 passed 1737075
output packets logged: blocked 0 passed 0
packets logged: input 0 output 0
log failures: input 0 output 0
fragment state(in): kept 531 lost 0
fragment state(out): kept 694 lost 368
packet state(in): kept 2034663 lost 10009
packet state(out): kept 114988 lost 210
ICMP replies: 0 TCP RSTs sent: 0
Invalid source(in): 0
Result cache hits(in): 133640 (out): 2140
IN Pullups succeeded: 0 failed: 0
OUT Pullups succeeded: 0 failed: 0
Fastroute successes: 0 failures: 0
TCP cksum fails(in): 1 (out): 0
Packet log flags set: (0)
# ipfstat -s
IP states added:
1611345 TCP
430452 UDP
110797 ICMP
531756429 hits
3303477 misses
0 maximum
0 no memory
21413 bkts in use
24913 active
540682 expired
1587013 closed
# ipnat -s
mapped in 37059421 out 39451916
added 1686146 expired 1669639
no memory 0 bad nat 263
inuse 16507
rules 1882
wilds 6
# netstat -m
993/1440/65536 mbufs in use (current/peak/max):
991 mbufs allocated to data
2 mbufs allocated to packet headers
989/1432/8192 mbuf clusters in use (current/peak/max)
3224 Kbytes allocated to network (9% of mb_map in use)
0 requests for memory denied
0 requests for memory delayed
0 calls to protocol drain routines
# uptime
10:09PM up 15:23, 1 user, load averages: 0.00, 0.01, 0.00
Uptime is short because I upgraded my box to FreeBSD 4.7-STABLE and
ipfilter 3.4.31 last night. My hardware configuration: Intel L440GX+
motherboard, 2 x Pentium II 350, 256MB RAM, Intel PRO/100+ Server
Adapter, IBM DPSS-336950N LVD SCSI HDD. CPU utilization is about 20%.
This configuration is 'overmuscled', but, like you said, it's better to
have some resources in reserve.
Tomasz
