On Thu, 15 Apr 2010, Darren Reed wrote: > So there's one other issue that it could be and that is if > there are too many entries in the same hash bucket.
Got an update from Sun support, they're thinking it's a bug with connections reusing the same source port... ----------------------------------------------------------------------- I think I found a relationship with lost and blocked packets and what triggers it. It looks like it is an issue related to TCP ports being reused - similar to this bug which was fixed a while ago. 6531894 IPF blocks TCP SYN packets for connections in TIME_WAIT state -> some clients can't reconnect 04/14/10-15:59 270 in use lost 1466 04/14/10-16:00 323 in use lost 1467 Apr 14 16:00:13 kyle ipmon[117]: [ID 702911 local0.warning] 16:00:13.167168 e1000g0 @20:11 b 134.71.247.43,43034 -> 134.71.247.14,80 PR tcp len 20 60 -S IN 10 15:58:43.44771 134.71.247.14 -> 134.71.247.43 TCP D=43034 S=80 Fin Ack=495580729 Seq=1186132000 Len=0 Win=49232 Options=<nop,nop,tstamp 171551837 1687035435> 11 15:58:43.44781 134.71.247.43 -> 134.71.247.14 TCP D=80 S=43034 Ack=1186132001 Seq=495580729 Len=0 Win=54 Options=<nop,nop,tstamp 1687035435 171551837> - >12 16:00:13.16715 134.71.247.43 -> 134.71.247.14 TCP D=80 S=43034 Syn Seq=1913409678 Len=0 Win=5840 Options=<mss 1460,sackOK,tstamp 1687057864 0,nop,wscale 7> 13 16:00:13.16718 134.71.247.14 -> 134.71.247.43 TCP D=43034 S=80 Rst Ack=1913409679 Win=0 04/14/10-16:04 251 in use lost 1467 04/14/10-16:05 345 in use lost 1468 Apr 14 16:04:26 kyle ipmon[117]: [ID 702911 local0.warning] 16:04:25.604612 e1000g0 @20:10 b 134.71.68.209,813 -> 134.71.247.14,2049 PR tcp len 20 60 -S IN 32 16:02:58.58262 134.71.247.14 -> 134.71.68.209 TCP D=813 S=2049 Fin Ack=3325530777 Seq=1680234158 Len=0 Win=49232 Options=<nop,nop,tstamp 171577350 27868927> 33 19:02:58.58301 134.71.68.209 -> 134.71.247.14 TCP D=2049 S=813 Ack=1680234159 Seq=3325530777 Len=0 Win=578 Options=<nop,nop,tstamp 27868927 171577350> -> 34 16:04:25.60459 134.71.68.209 -> 134.71.247.14 TCP D=2049 S=813 Syn Seq=3782135592 Len=0 Win=5840 Options=<mss 1460,sackOK,tstamp 27955964 0,nop,wscale 7> 35 16:04:25.60463 134.71.247.14 -> 134.71.68.209 TCP D=813 S=2049 Rst Ack=3782135593 Win=0 36 16:04:31.60337 134.71.68.209 -> 134.71.247.14 TCP D=2049 S=813 Syn Seq=3782135595 Len=0 Win=5840 Options=<mss 1460,sackOK,tstamp 27961964 0,nop,wscale 7> 04/14/10-16:06 325 in use lost 1468 04/14/10-16:07 287 in use lost 1469 Apr 14 16:06:53 kyle ipmon[117]: [ID 702911 local0.warning] 16:06:53.145654 e1000g0 @20:10 b 134.71.68.243,844 -> 134.71.247.14,2049 PR tcp len 20 60 -S IN 45 16:04:55.57943 134.71.247.14 -> 134.71.68.243 TCP D=844 S=2049 Fin Ack=146698100 Seq=2607094693 Len=0 Win=49232 Options=<nop,nop,tstamp 171589050 27774756> 46 19:04:55.57983 134.71.68.243 -> 134.71.247.14 TCP D=2049 S=844 Ack=2607094694 Seq=146698100 Len=0 Win=501 Options=<nop,nop,tstamp 27774756 171589050> -> 47 16:06:53.14563 134.71.68.243 -> 134.71.247.14 TCP D=2049 S=844 Syn Seq=1694971762 Len=0 Win=5840 Options=<mss 1460,sackOK,tstamp 27892323 0,nop,wscale 7> 48 16:06:53.14567 134.71.247.14 -> 134.71.68.243 TCP D=844 S=2049 Rst Ack=1694971763 Win=0 49 16:06:59.14540 134.71.68.243 -> 134.71.247.14 TCP D=2049 S=844 Syn Seq=1694971765 Len=0 Win=5840 Options=<mss 1460,sackOK,tstamp 27898323 0,nop,wscale 7> -- Paul B. Henson | (909) 979-6361 | http://www.csupomona.edu/~henson/ Operating Systems and Network Analyst | [email protected] California State Polytechnic University | Pomona CA 91768
