On Tue, 09 Feb 2010 17:44:01 EST, Andrey Gordon said: > It does seem much like NAT exhaustion even though the f/w claims only 13K > session for two dynamic NATs and about 20 static ones. > What I don't get is why there is consistency in opening sites. Why does > facebook open all the time and store.apple.com barely opens all the time.
This sounds like possibly a hash table with a spectacularly poor hash function, causing most of your entries to be in only a few hash buckets. You hit one of the 497 buckets that has 0 or 1 or 3 entries, it works great. You hit one of 3 buckets that has 4,000+ entries in it, things suck. (You Linux geeks can quit smirking - Linux had a very similar issue in its networking stack not so long ago). Never underestimate the ability of vendor engineers to write hilariously poor code: http://thedailywtf.com/Articles/Else-where.aspx You really gotta assume that your firewall code (or any other code, for that matter) was written by that programmer until proved otherwise.
pgpDMLvikQ1Zt.pgp
Description: PGP signature
