Re: Performance of PPPOE in FreeBSD
On Mon, Sep 20, 2021 at 09:32:22PM +0200, driesm.michi...@gmail.com wrote: > Hi net mailing list, Hi Dries, > > > > Currently at my parrents house we have just a cable modem where I use DHCPv6 > and DHCP to get a IPv6 prefix and IPv4 address respectivelly. > > For this config everything is done in the kernel regarding routing. The ISP > is Telenet and they give me 300 down / 20 up (mbps). > > > > But I really want a higher upload in my future appartment where I will be > moving is *soonTm*. > > So looking for ISP's in Belgium, Proximus seems to provide a fibre plan (if > fibre is available, but it should be) that does 500 down / 50 up (mbps). > > They use PPPOE and was wondering what the max troughput looks like with the > in-base PPPOE client? > On my small APU2C4 box the in-base PPPOE client used 100% CPU, I strongly suggest to switch to mpd5 (which use < 1% CPU on the same hardware) > I have also found some mentions of net/mpd5, is this a better > implementation? > yes! mpd5 is almost mandatory nowadays for PPPOE > > > Thanks > > Dries > -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: CARP with epair
On Mon, Nov 09, 2020 at 05:55:05PM -0800, John-Mark Gurney wrote: > Julien Cigar wrote this message on Mon, Nov 09, 2020 at 15:33 +0100: > > Hello, > > > > I've setup a VNET jail (with epair and bridge) with a floating ip (vhid) > > on the "b" side of the epair interface. It works well, as soon as I > > restart the jail: the carp status stays in BACKUP and never return to > > MASTER. Any idea what I'm missing? Is CARP supposed to work with epair? > > Did you set net.inet.carp.preempt=1? Or do you not yet have another > peer and that is why you expect that it'd come back as MASTER? Yes, I've set net.inet.carp.preempt=1 in the VNET jail /etc/sysctl.conf, and I have another peer (running on the HOST currently). I found the problem: for some reasons I had to issue a service pf reload after a restart of the jail. I guess probably some race condition with the epair/vlan/... interfaces and/or the carp demotion counter and the pflogd/pfsync interfaces .. I've to investigate this is my config: https://gist.github.com/silenius/5f556a036330f1595e2e6fcdd5e5e18e Thank you, Julien > > -- > John-Mark GurneyVoice: +1 415 225 5579 > > "All that I will do, has been done, All that I have, has not." > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
CARP with epair
Hello, I've setup a VNET jail (with epair and bridge) with a floating ip (vhid) on the "b" side of the epair interface. It works well, as soon as I restart the jail: the carp status stays in BACKUP and never return to MASTER. Any idea what I'm missing? Is CARP supposed to work with epair? Thanks, Julien -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
Re: CARP over VLAN over LAGG
On Tue, Sep 01, 2020 at 10:13:23AM +0200, Julien Cigar wrote: > On Mon, Aug 31, 2020 at 01:55:52PM +0200, Michael Gmelin wrote: > > > > > > > On 31. Aug 2020, at 10:37, Julien Cigar wrote: > > > > > > On Fri, Aug 28, 2020 at 04:52:01PM +0200, Julien Cigar wrote: > > >> Hello, > > >> > > >> I have a "highly available" router/firewall with the following > > >> configuration (1). Those are plugged in two 2930F (with VSF) using LACP. > > >> It works well, except that I have some weird issues with the CARP > > >> demotion counter when I'm unplugging some interfaces involved in the > > >> lagg/carp setup, for example if I unplug/replug igb0 and igb1 in this > > >> case: > > >> > > >> (dmesg): > > >> igb0: link state changed to DOWN > > >> igb1: link state changed to DOWN > > >> carp: demoted by 240 to 240 (send error 50 on vlan11) > > >> carp: 11@vlan11: MASTER -> BACKUP (more frequent advertisement received) > > >> vlan11: deletion failed: 3 > > >> igb1: link state changed to UP > > >> igb0: link state changed to UP > > >> > > >> then the CARP status stays to BACKUP unless I demote the CARP demotion > > >> counter manually with: sudo sysctl net.inet.carp.demotion=-240: > > >> > > >> (dmesg): > > >> carp: demoted by -240 to 0 (sysctl) > > >> carp: 11@vlan11: BACKUP -> MASTER (preempting a slower master) > > >> > > >> I guess this is because it takes some time for lagg/lacp to converge and > > >> thus carp thinks that there is a problematic condition as it experiences > > >> problems with sending announcements.. > > >> > > >> What it the best way to handle this? > > > > > > I'm wondering if setting net.inet.carp.senderr_demotion_factor to "0" > > > could be a solution? Are there any downsides of setting this to "0" > > > instead of "240"? > > > > > > > Sharing your pf.conf from both hosts could be helpful analyzing the issue. > > Here is my pf.conf (it's the same on both host): > https://gist.github.com/silenius/b758851f03c28ef8caaa53cfe381c455 > > However, I don't think pf is the issue here, the problem is that there > is a slight delay when LAGG/LACP converge and thus CARP increase the > demotion counter by net.inet.carp.senderr_demotion_factor (240). I can confirm that after setting net.inet.carp.senderr_demotion_factor=0 (instead of 240) it works as expected. > > > > > -m > > > > > > -- > Julien Cigar > Belgian Biodiversity Platform (http://www.biodiversity.be) > PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 > No trees were killed in the creation of this message. > However, many electrons were terribly inconvenienced. > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
Re: CARP over VLAN over LAGG
On Mon, Aug 31, 2020 at 01:55:52PM +0200, Michael Gmelin wrote: > > > > On 31. Aug 2020, at 10:37, Julien Cigar wrote: > > > > On Fri, Aug 28, 2020 at 04:52:01PM +0200, Julien Cigar wrote: > >> Hello, > >> > >> I have a "highly available" router/firewall with the following > >> configuration (1). Those are plugged in two 2930F (with VSF) using LACP. > >> It works well, except that I have some weird issues with the CARP > >> demotion counter when I'm unplugging some interfaces involved in the > >> lagg/carp setup, for example if I unplug/replug igb0 and igb1 in this > >> case: > >> > >> (dmesg): > >> igb0: link state changed to DOWN > >> igb1: link state changed to DOWN > >> carp: demoted by 240 to 240 (send error 50 on vlan11) > >> carp: 11@vlan11: MASTER -> BACKUP (more frequent advertisement received) > >> vlan11: deletion failed: 3 > >> igb1: link state changed to UP > >> igb0: link state changed to UP > >> > >> then the CARP status stays to BACKUP unless I demote the CARP demotion > >> counter manually with: sudo sysctl net.inet.carp.demotion=-240: > >> > >> (dmesg): > >> carp: demoted by -240 to 0 (sysctl) > >> carp: 11@vlan11: BACKUP -> MASTER (preempting a slower master) > >> > >> I guess this is because it takes some time for lagg/lacp to converge and > >> thus carp thinks that there is a problematic condition as it experiences > >> problems with sending announcements.. > >> > >> What it the best way to handle this? > > > > I'm wondering if setting net.inet.carp.senderr_demotion_factor to "0" > > could be a solution? Are there any downsides of setting this to "0" > > instead of "240"? > > > > Sharing your pf.conf from both hosts could be helpful analyzing the issue. Here is my pf.conf (it's the same on both host): https://gist.github.com/silenius/b758851f03c28ef8caaa53cfe381c455 However, I don't think pf is the issue here, the problem is that there is a slight delay when LAGG/LACP converge and thus CARP increase the demotion counter by net.inet.carp.senderr_demotion_factor (240). > > -m > > -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
Re: CARP over VLAN over LAGG
On Fri, Aug 28, 2020 at 04:52:01PM +0200, Julien Cigar wrote: > Hello, > > I have a "highly available" router/firewall with the following > configuration (1). Those are plugged in two 2930F (with VSF) using LACP. > It works well, except that I have some weird issues with the CARP > demotion counter when I'm unplugging some interfaces involved in the > lagg/carp setup, for example if I unplug/replug igb0 and igb1 in this > case: > > (dmesg): > igb0: link state changed to DOWN > igb1: link state changed to DOWN > carp: demoted by 240 to 240 (send error 50 on vlan11) > carp: 11@vlan11: MASTER -> BACKUP (more frequent advertisement received) > vlan11: deletion failed: 3 > igb1: link state changed to UP > igb0: link state changed to UP > > then the CARP status stays to BACKUP unless I demote the CARP demotion > counter manually with: sudo sysctl net.inet.carp.demotion=-240: > > (dmesg): > carp: demoted by -240 to 0 (sysctl) > carp: 11@vlan11: BACKUP -> MASTER (preempting a slower master) > > I guess this is because it takes some time for lagg/lacp to converge and > thus carp thinks that there is a problematic condition as it experiences > problems with sending announcements.. > > What it the best way to handle this? I'm wondering if setting net.inet.carp.senderr_demotion_factor to "0" could be a solution? Are there any downsides of setting this to "0" instead of "240"? > > Thanks, > Julien > > (1) https://gist.github.com/silenius/577606b596ff1d220bbfd9956d05baef > > -- > Julien Cigar > Belgian Biodiversity Platform (http://www.biodiversity.be) > PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 > No trees were killed in the creation of this message. > However, many electrons were terribly inconvenienced. > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
CARP over VLAN over LAGG
Hello, I have a "highly available" router/firewall with the following configuration (1). Those are plugged in two 2930F (with VSF) using LACP. It works well, except that I have some weird issues with the CARP demotion counter when I'm unplugging some interfaces involved in the lagg/carp setup, for example if I unplug/replug igb0 and igb1 in this case: (dmesg): igb0: link state changed to DOWN igb1: link state changed to DOWN carp: demoted by 240 to 240 (send error 50 on vlan11) carp: 11@vlan11: MASTER -> BACKUP (more frequent advertisement received) vlan11: deletion failed: 3 igb1: link state changed to UP igb0: link state changed to UP then the CARP status stays to BACKUP unless I demote the CARP demotion counter manually with: sudo sysctl net.inet.carp.demotion=-240: (dmesg): carp: demoted by -240 to 0 (sysctl) carp: 11@vlan11: BACKUP -> MASTER (preempting a slower master) I guess this is because it takes some time for lagg/lacp to converge and thus carp thinks that there is a problematic condition as it experiences problems with sending announcements.. What it the best way to handle this? Thanks, Julien (1) https://gist.github.com/silenius/577606b596ff1d220bbfd9956d05baef -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ___ freebsd-net@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org"
Re: CARP and NAT question
On Wed, Oct 09, 2019 at 12:50:49PM -0700, Julian Elischer wrote: > On 10/9/19 2:34 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: > >> On 10/8/19 8:58 AM, Julien Cigar wrote: > >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >>>> Hi Julien, > >>> Hi Matthew, > >>> > >>>> It's not clear why you are trying to assign multiple carp IP address to > >>>> two different interfaces from within the same IP subnet. Are you trying > >>>> to fail over a 2nd carp address or are you trying to improve > >>>> throughput/redundancy? If you just want to fail over a 2nd carp address, > >>>> assign a 2nd alias to your first interface. If your trying to improve > >>>> throughput/redundancy, assign both interfaces to a lagg and build your > >>>> carp interfaces on top of that instead. > >>>> > >>> Currently outbound traffic from $net1 and $net2 (two private networks) > >>> pass through the same network interface (igb0) (as you can see in (1) > >>> in my previous post) on the router. I'd like to prevent that > >>> $net2 saturates the interface and slow down traffic from $net1 (which is > >>> more important). I could lagg and build CARP on top of that but it > >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ > >>> of course, which I'd like to avoid). > >>> > >>>> -Matthew > >>>> > >>>> On 10/8/2019 8:48 AM, Julien Cigar wrote: > >>>>> Hello, > >>>>> > >>>>> I'd like to NAT outbound traffic from two different private networks > >>>>> through two different interfaces, with CARP on top. I have 4 public IPS > >>>>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > >>>>> > >>>>> I have two redundant router/firewall running FreeBSD 12 with CARP and > >>>>> PF with the following: (1) which works well, but all traffic > >>>>> goes through the same interface. > >>>>> > >>>>> So I'd like to switch to something like (2), which will not work (lines > >>>>> 5 and 13 are not valid) and I'm wondering if I could use something like > >>>>> (3) ..? > >>>>> > >>>>> Thank you! > >>>>> Julien > >>>>> > >>>>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 > >>>>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 > >>>>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db > >>>>> > >>>> ___ > >>>> freebsd-net@freebsd.org mailing list > >>>> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >>>> To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > >> can you draw it? > > yes, see https://ibb.co/mv5RPM9 > > so, you have several ways of doing this: > > one is to assign a different routing table to each class of traffic. > > Each table has a different default route, sending data out to a > different external interface. > > Each interface out is NAT'd so that the return packets will come back > the same way. I haven't played with multiple FIB(s) yet (which still require a custom kernel with options ROUTETABLES, I think?) but I'll take a look. As I can see it's a little bit more more work than the route-to PF route option. > > But you only have a single pipe to the internet, So one wonders how > that helps with redundancy? > Adding a second switch and another redundant link is also planned, but at the moment by "redundancy" I was talking of router1 and router2, and the integration with CARP, especially the "real" addresses on the interfaces as I have only 4 public ones and 3 of them are already used on the first interface. But I think that starting with FreeBSD 11 (?) real and virtual addresses couldn't be in the same subnet, for example I think this should work: ### # router1 # ### ifconfig_igb0="inet 193.1.2.89 netmask 255.255.255.224 -tso" ifconfig_igb0_alias0="inet vhid 53 advskew 0 pass xxx alias 193.1.2.90/32" ifconfig_igb1="inet 10.1.2.3 netmask 255.255.255.224 -tso" ifconfig_igb1_alias0="inet vhid 54 advskew 0 pass xxx alias 193.1.2.92/32" ### # router2 # ### ifconfig_igb0="inet 193.1.2.91 netmask 255.255.255.224 -tso" ifconfig_igb0_alias0="inet vhid 53 advskew 100 pass xxx alias 193.1.2.90/32" ifconfig_igb1="inet 10.1.2.4 netmask 255.255.255.224 -tso" ifconfig_igb1_alias0="inet vhid 54 advskew 100 pass xxx alias 193.1.2.92/32" > > thanks for you help :) Julien > > > > >> > >> ___ > >> freebsd-net@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >> To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > > -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: CARP and NAT question
On Wed, Oct 09, 2019 at 01:41:40PM -0500, Matthew Grooms wrote:
> On 10/9/2019 4:10 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
> >> On 10/8/2019 10:58 AM, Julien Cigar wrote:
> >>> On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >>>> Hi Julien,
> >>> Hi Matthew,
> >>>
> >>>> It's not clear why you are trying to assign multiple carp IP address to
> >>>> two different interfaces from within the same IP subnet. Are you trying
> >>>> to fail over a 2nd carp address or are you trying to improve
> >>>> throughput/redundancy? If you just want to fail over a 2nd carp address,
> >>>> assign a 2nd alias to your first interface. If your trying to improve
> >>>> throughput/redundancy, assign both interfaces to a lagg and build your
> >>>> carp interfaces on top of that instead.
> >>>>
> >>> Currently outbound traffic from $net1 and $net2 (two private networks)
> >>> pass through the same network interface (igb0) (as you can see in (1)
> >>> in my previous post) on the router. I'd like to prevent that
> >>> $net2 saturates the interface and slow down traffic from $net1 (which is
> >>> more important). I could lagg and build CARP on top of that but it
> >>> wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
> >>> of course, which I'd like to avoid).
> >> Well, I'm not sure how well it will work but I think what you are
> >> looking for is the route-to pf rule option. You can specify that certain
> >> traffic be transmitted via a specific network interface to a specific
> >> next hop. However, I believe you'll need to match traffic as it's
> >> received on the internal interface, ie. before the kernel determines the
> >> egress interface.
> >>
> >> table internal_networks { $net1, $net2 }
> >> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1
> >> to !
> >> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2
> >> to !
> > Thanks, I haven't used the route-to yet but if I understand well it's
> > a way to "bypass" the default route/interface?
>
> Yes. It's essentially pf's way of providing policy based routing in the
> rule set.
Excellent, it looks exactly what I need
Thanks!
>
> -Matthew
>
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
signature.asc
Description: PGP signature
Re: CARP and NAT question
On Tue, Oct 08, 2019 at 01:05:37PM -0700, Julian Elischer wrote: > On 10/8/19 8:58 AM, Julien Cigar wrote: > > On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > >> Hi Julien, > > Hi Matthew, > > > >> It's not clear why you are trying to assign multiple carp IP address to > >> two different interfaces from within the same IP subnet. Are you trying > >> to fail over a 2nd carp address or are you trying to improve > >> throughput/redundancy? If you just want to fail over a 2nd carp address, > >> assign a 2nd alias to your first interface. If your trying to improve > >> throughput/redundancy, assign both interfaces to a lagg and build your > >> carp interfaces on top of that instead. > >> > > Currently outbound traffic from $net1 and $net2 (two private networks) > > pass through the same network interface (igb0) (as you can see in (1) > > in my previous post) on the router. I'd like to prevent that > > $net2 saturates the interface and slow down traffic from $net1 (which is > > more important). I could lagg and build CARP on top of that but it > > wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ > > of course, which I'd like to avoid). > > > >> -Matthew > >> > >> On 10/8/2019 8:48 AM, Julien Cigar wrote: > >>> Hello, > >>> > >>> I'd like to NAT outbound traffic from two different private networks > >>> through two different interfaces, with CARP on top. I have 4 public IPS > >>> available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > >>> > >>> I have two redundant router/firewall running FreeBSD 12 with CARP and > >>> PF with the following: (1) which works well, but all traffic > >>> goes through the same interface. > >>> > >>> So I'd like to switch to something like (2), which will not work (lines > >>> 5 and 13 are not valid) and I'm wondering if I could use something like > >>> (3) ..? > >>> > >>> Thank you! > >>> Julien > >>> > >>> (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 > >>> (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 > >>> (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db > >>> > >> ___ > >> freebsd-net@freebsd.org mailing list > >> https://lists.freebsd.org/mailman/listinfo/freebsd-net > >> To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > > can you draw it? yes, see https://ibb.co/mv5RPM9 > > > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: CARP and NAT question
On Tue, Oct 08, 2019 at 11:22:51AM -0500, Matthew Grooms wrote:
> On 10/8/2019 10:58 AM, Julien Cigar wrote:
> > On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote:
> >> Hi Julien,
> > Hi Matthew,
> >
> >> It's not clear why you are trying to assign multiple carp IP address to
> >> two different interfaces from within the same IP subnet. Are you trying
> >> to fail over a 2nd carp address or are you trying to improve
> >> throughput/redundancy? If you just want to fail over a 2nd carp address,
> >> assign a 2nd alias to your first interface. If your trying to improve
> >> throughput/redundancy, assign both interfaces to a lagg and build your
> >> carp interfaces on top of that instead.
> >>
> > Currently outbound traffic from $net1 and $net2 (two private networks)
> > pass through the same network interface (igb0) (as you can see in (1)
> > in my previous post) on the router. I'd like to prevent that
> > $net2 saturates the interface and slow down traffic from $net1 (which is
> > more important). I could lagg and build CARP on top of that but it
> > wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ
> > of course, which I'd like to avoid).
>
> Well, I'm not sure how well it will work but I think what you are
> looking for is the route-to pf rule option. You can specify that certain
> traffic be transmitted via a specific network interface to a specific
> next hop. However, I believe you'll need to match traffic as it's
> received on the internal interface, ie. before the kernel determines the
> egress interface.
>
> table internal_networks { $net1, $net2 }
> pass in on $internal_interface route-to( igb0 $default_gw ) from $net1
> to !
> pass in on $internal_interface route-to( igb1 $default_gw ) from $net2
> to !
Thanks, I haven't used the route-to yet but if I understand well it's
a way to "bypass" the default route/interface?
>
> Hope this helps,
>
> -Matthew
>
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
signature.asc
Description: PGP signature
Re: CARP and NAT question
On Tue, Oct 08, 2019 at 10:20:34AM -0500, Matthew Grooms wrote: > Hi Julien, Hi Matthew, > > It's not clear why you are trying to assign multiple carp IP address to > two different interfaces from within the same IP subnet. Are you trying > to fail over a 2nd carp address or are you trying to improve > throughput/redundancy? If you just want to fail over a 2nd carp address, > assign a 2nd alias to your first interface. If your trying to improve > throughput/redundancy, assign both interfaces to a lagg and build your > carp interfaces on top of that instead. > Currently outbound traffic from $net1 and $net2 (two private networks) pass through the same network interface (igb0) (as you can see in (1) in my previous post) on the router. I'd like to prevent that $net2 saturates the interface and slow down traffic from $net1 (which is more important). I could lagg and build CARP on top of that but it wouldn't prevent $net2 to saturate the interface (unless I'm plugin ALTQ of course, which I'd like to avoid). > -Matthew > > On 10/8/2019 8:48 AM, Julien Cigar wrote: > > Hello, > > > > I'd like to NAT outbound traffic from two different private networks > > through two different interfaces, with CARP on top. I have 4 public IPS > > available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). > > > > I have two redundant router/firewall running FreeBSD 12 with CARP and > > PF with the following: (1) which works well, but all traffic > > goes through the same interface. > > > > So I'd like to switch to something like (2), which will not work (lines > > 5 and 13 are not valid) and I'm wondering if I could use something like > > (3) ..? > > > > Thank you! > > Julien > > > > (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 > > (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 > > (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db > > > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
CARP and NAT question
Hello, I'd like to NAT outbound traffic from two different private networks through two different interfaces, with CARP on top. I have 4 public IPS available (193.x.x.89, 193.x.x.90, 193.x.x.91, 193.x.x.92). I have two redundant router/firewall running FreeBSD 12 with CARP and PF with the following: (1) which works well, but all traffic goes through the same interface. So I'd like to switch to something like (2), which will not work (lines 5 and 13 are not valid) and I'm wondering if I could use something like (3) ..? Thank you! Julien (1) https://gist.github.com/silenius/4f6173a9b6690292c2174ab3bb89d292 (2) https://gist.github.com/silenius/da9be7e74e9861fa55f927d194e3e410 (3) https://gist.github.com/silenius/b237565b0d181248ff80ea296e5537db -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: mbuf_jumbo_9k & iSCSI failing
On Mon, Jun 26, 2017 at 04:13:33PM +0300, Andrey V. Elsukov wrote: > On 25.06.2017 18:32, Ryan Stone wrote: > > Having looking at the original email more closely, I see that you showed an > > mlxen interface with a 9020 MTU. Seeing allocation failures of 9k mbuf > > clusters increase while you are far below the zone's limit means that > > you're definitely running into the bug I'm describing, and this bug could > > plausibly cause the iSCSI errors that you describe. > > > > The issue is that the newer version of the driver tries to allocate a > > single buffer to accommodate an MTU-sized packet. Over time, however, > > memory will become fragmented and eventually it can become impossible to > > allocate a 9k physically contiguous buffer. When this happens the driver > > is unable to allocate buffers to receive packets and is forced to drop > > them. Presumably, if iSCSI suffers too many packet drops it will terminate > > the connection. The older version of the driver limited itself to > > page-sized buffers, so it was immune to issues with memory fragmentation. > > I think it is not mlxen specific problem, we have the same symptoms with > ixgbe(4) driver too. To avoid the problem we have patches that are > disable using of 9k mbufs, and instead only use 4k mbufs. I had the same issue on a lightly loaded HP DL20 machine (BCM5720 chipsets), 8GB of RAM, running 10.3. Problem usually happens within 30 days with 9k jumbo clusters allocation failure. > > -- > WBR, Andrey V. Elsukov > -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: VLAN + CARP ?
On Mon, Feb 27, 2017 at 03:37:14PM -0800, Freddie Cash wrote: > On Mon, Feb 27, 2017 at 3:16 PM, Julien Cigar <jul...@perdition.city> wrote: > > > > I wondered if it is possible to use CARP with VLAN interfaces? > > > > Yes, CARP-over-vLAN works well. Used just such a setup at work for a > couple years. > > Would something like this work (on 10.3)..?: > > > > = /etc/rc.conf > > > > vlans_em0="neta netb" > > create_args_neta="vlan 101" > > create_args_netb="vlan 102" > > > > ifconfig_em0_neta="inet 192.168.1.253/24" > > ifconfig_em0_netb="inet 10.209.1.253/24" > > > > ifconfig_em0_neta_alias0="inet vhid 3 advskew 10 pass xx alias > > 192.168.2.254/32" > > ifconfig_em0_netb_alias0="inet vhid 4 advskew 10 pass xx alias > > 10.209.1.254/32" > > > > === > > > > This is the setup we used (snipped for brevity): > > # em2 is the 3rd NIC port from the top of the quad-port NIC > ifconfig_em2="up" > vlans_em2="vlan110 vlan2000 vlan1000 vlan1010 vlan1110" > > create_args_vlan1000="vlan 1000" > ifconfig_vlan1000="vhid 9 pass nxsp4ss > 1 > advskew 128 10.1.0.1/16" > > create_args_vlan2000="vlan 2000" > ifconfig_vlan2000="vhid 20 pass nxsp4ss2 advskew 128 12.24.13.97/27" > > create_args_vlan1010="vlan 1010" > ifconfig_vlan1010="vhid 21 pass nxsp4ss > 3 > advskew 128 12.24.12.129/26" > > create_args_vlan1110="vlan 1110" > ifconfig_vlan1110="vhid 11 pass nxsp4ss > 4 > advskew 128 12.24.10.1/26" > > em2 had no IPs associated with it, it was just the physical interface that > the vlans and carp traffic went over. We also only had a single subnet per > vlan, so only a single IP per carp instance on each vlan. But you can do > multiples using the alias syntax like you have. excellent, this is exactly what I need, thanks! > > -- > Freddie Cash > fjwc...@gmail.com -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
VLAN + CARP ?
Hello, I wondered if it is possible to use CARP with VLAN interfaces? Would something like this work (on 10.3)..?: = /etc/rc.conf vlans_em0="neta netb" create_args_neta="vlan 101" create_args_netb="vlan 102" ifconfig_em0_neta="inet 192.168.1.253/24" ifconfig_em0_netb="inet 10.209.1.253/24" ifconfig_em0_neta_alias0="inet vhid 3 advskew 10 pass xx alias 192.168.2.254/32" ifconfig_em0_netb_alias0="inet vhid 4 advskew 10 pass xx alias 10.209.1.254/32" === Thanks! Julien -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: carp and subnets
On Tue, Feb 14, 2017 at 09:03:00AM -0800, Freddie Cash wrote:
> On Tue, Feb 14, 2017 at 7:41 AM, Julien Cigar <jul...@perdition.city> wrote:
>
> > Hello,
> >
> > I have a redundant router/firewall with CARP and PF/PFSync with the
> > following configuration (simplified for example):
> >
> > on FW1 (MASTER):
> >
> > ifconfig_em3="inet 1.2.208.89 netmask 255.255.255.224 -tso"
> > ifconfig_em3_alias0="vhid 53 advskew 0 pass xx alias 1.2.208.90/32"
> >
> > on FW2 (BACKUP):
> >
> > ifconfig_em3="inet 1.2.208.91 netmask 255.255.255.224 -tso"
> > ifconfig_em3_alias0="vhid 53 advskew 100 pass xx alias 1.2.208.90/32"
> >
> > on both machines I have something like this in my /etc/pf.conf:
> > net_local="10.209.1.0/24"
> > net_prod="192.168.10.0/24"
> > if_wan="em3"
> > CARPvhid53="1.2.208.90"
> > nat on $if_wan from { $net_local, $net_prod } to any -> $CARPvhid53
> >
> > it works great but I have a couple of questions:
> >
> > - is it possible to use differents subnets for the "real" ips and the
> > CARP vip ? in other words: I only have three public IPs and I'd like
> > to reuse two of them. I wondered of something like this would work:
> >
> > on FW1 (MASTER):
> >
> > ifconfig_em3="inet 192.168.88.1 netmask 255.255.255.0 -tso"
> > ifconfig_em3_alias0="vhid 53 advskew 0 pass xx alias 1.2.208.90/32"
> >
> > on FW2 (BACKUP):
> >
> > ifconfig_em3="inet 192.168.88.2 netmask 255.255.255.0 -tso"
> > ifconfig_em3_alias0="vhid 53 advskew 100 pass xx alias 1.2.208.90/32"
> >
> > (assuming that the switch is configured properly)
> >
> > - as the state table is synced between FW1 and FW2, is it possible to
> > do some load-balancing on the outgoing address?
> >
> > Thanks!
> >
>
> With FreeBSD 9.x and earlier, no, you can't. The CARP setup uses the
> IP/subnet of the host interface for sending the CARP messages.
>
> With FreeBSD 10.x and above, yes, you can. The CARP setup uses the
> IP/subnet of the VHID for sending CARP messages, which can be set to
> anything. So long as all the member VHID interfaces are on the same subnet
> and connection. It's one of the many nice things about the new CARP stuff
> on FreeBSD 10.x.
excellent, thank you!
>
> --
> Freddie Cash
> fjwc...@gmail.com
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
signature.asc
Description: PGP signature
carp and subnets
Hello,
I have a redundant router/firewall with CARP and PF/PFSync with the
following configuration (simplified for example):
on FW1 (MASTER):
ifconfig_em3="inet 1.2.208.89 netmask 255.255.255.224 -tso"
ifconfig_em3_alias0="vhid 53 advskew 0 pass xx alias 1.2.208.90/32"
on FW2 (BACKUP):
ifconfig_em3="inet 1.2.208.91 netmask 255.255.255.224 -tso"
ifconfig_em3_alias0="vhid 53 advskew 100 pass xx alias 1.2.208.90/32"
on both machines I have something like this in my /etc/pf.conf:
net_local="10.209.1.0/24"
net_prod="192.168.10.0/24"
if_wan="em3"
CARPvhid53="1.2.208.90"
nat on $if_wan from { $net_local, $net_prod } to any -> $CARPvhid53
it works great but I have a couple of questions:
- is it possible to use differents subnets for the "real" ips and the
CARP vip ? in other words: I only have three public IPs and I'd like
to reuse two of them. I wondered of something like this would work:
on FW1 (MASTER):
ifconfig_em3="inet 192.168.88.1 netmask 255.255.255.0 -tso"
ifconfig_em3_alias0="vhid 53 advskew 0 pass xx alias 1.2.208.90/32"
on FW2 (BACKUP):
ifconfig_em3="inet 192.168.88.2 netmask 255.255.255.0 -tso"
ifconfig_em3_alias0="vhid 53 advskew 100 pass xx alias 1.2.208.90/32"
(assuming that the switch is configured properly)
- as the state table is synced between FW1 and FW2, is it possible to
do some load-balancing on the outgoing address?
Thanks!
Julien
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
signature.asc
Description: PGP signature
Re: FW: iSCSI failing, MLX rx_ring errors ?
a replacement page */ > > if (mlx4_en_alloc_buf(priv, rx_desc, mb_list, nr)) > > goto fail; > > > > -Meny > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" > ___ > freebsd-net@freebsd.org mailing list > https://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscr...@freebsd.org" -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. signature.asc Description: PGP signature
Re: [jci...@ulb.ac.be: Listen queue overflow: 8 already in queue awaiting acceptance]
On Thu, Oct 02, 2014 at 04:36:49PM -0700, hiren panchasara wrote:
On Thu, Oct 2, 2014 at 11:19 AM, Julien Cigar jci...@ulb.ac.be wrote:
On Thu, Oct 02, 2014 at 10:24:13AM -0700, hiren panchasara wrote:
On Thu, Oct 2, 2014 at 9:42 AM, Julien Cigar jci...@ulb.ac.be wrote:
sorry for cross-posting, I'm forwarding this as it seems that part of
the problem is also related to:
https://lists.freebsd.org/pipermail/freebsd-net/2014-September/039664.html
Umm, this looks like a different problem than the subject of this email.
yes and no, seems the same hardware (HP and igb) and I have also some
requests for mbufs denied (https://dpaste.de/t8kJ/raw) without any
reasons. I should add that the box hanged a week ago and I had to do a
hard reboot, I have the feeling that it's somewhat related to this
problem ..
I suggest you try to debug these 2 problems separately. Did you get a
chance to look at kgdb to find the culprit process as I suggested
below?
I tried what you suggested, but I get a No struct type named inpcb
Any idea ? :)
cheers,
Hiren
I also wonder if something has been fixed in -STABLE in this area ..
(please keep me in CC as I'm not subscribed on freebsd-net@ an
freebsd-stable@)
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
-- Forwarded message --
From: Julien Cigar jci...@ulb.ac.be
To: freebsd-questi...@freebsd.org
Cc:
Date: Thu, 2 Oct 2014 11:52:06 +0200
Subject: Listen queue overflow: 8 already in queue awaiting acceptance
Hello,
I'm running 10-RELEASE on a HP Proliant DL160 Gen8 and I'm seeing the
following in my kernel logs:
sonewconn: pcb 0xf8010e561310: Listen queue overflow: 8 already in
queue awaiting acceptance
This usually means the application is not keeping up with the incoming
connections.
I already raised kern.ipc.soacceptqueue to 1024 and netstat -naA | grep
f8010e561310 returns nothing
This is the usual way of finding the culprit process. If this doesn't
return anything, it probably means that it is a short-lived process.
Here is an example of what you could do:
sonewconn: pcb 0xf8008f40cb10: Listen queue overflow: 1 already in
queue
awaiting acceptance
From kgdb,
(kgdb) p ((struct inpcb *)0xf8008f40cb10)-inp_inc
$3 = {inc_flags = 0 '\0', inc_len = 0 '\0', inc_fibnum = 0, inc_ie =
{ie_fport
= 0, ie_lport = 10295, ie_dependfaddr = {
ie46_foreign = {ia46_pad32 = {0, 0, 0}, ia46_addr4 = {s_addr = 0}},
ie6_foreign = {__u6_addr = {
__u6_addr8 = '\0' repeats 15 times, __u6_addr16 = {0, 0, 0, 0,
0,
0, 0, 0}, __u6_addr32 = {0, 0, 0, 0,
ie_dependladdr = {ie46_local = {ia46_pad32 = {0, 0, 0}, ia46_addr4 =
{s_addr = 0}}, ie6_local = {__u6_addr = {
__u6_addr8 = '\0' repeats 15 times, __u6_addr16 = {0, 0, 0, 0,
0,
0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}
Here, ie_lport = 10295 which is in n/w byte order and converting it to host
byte order, 10295 - 0x2837 and swapping them gives us 0x3728 which is
14120.
Now, use sockstat to find out what process is on that port:
$ sockstat -l | grep 14120
cheers,
Hiren
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
pgpU4WdpFBQN4.pgp
Description: PGP signature
[jci...@ulb.ac.be: Listen queue overflow: 8 already in queue awaiting acceptance]
sorry for cross-posting, I'm forwarding this as it seems that part of the problem is also related to: https://lists.freebsd.org/pipermail/freebsd-net/2014-September/039664.html I also wonder if something has been fixed in -STABLE in this area .. (please keep me in CC as I'm not subscribed on freebsd-net@ an freebsd-stable@) -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. ---BeginMessage--- Hello, I'm running 10-RELEASE on a HP Proliant DL160 Gen8 and I'm seeing the following in my kernel logs: sonewconn: pcb 0xf8010e561310: Listen queue overflow: 8 already in queue awaiting acceptance I already raised kern.ipc.soacceptqueue to 1024 and netstat -naA | grep f8010e561310 returns nothing Any idea what could it be ..? I've put some statistics here https://dpaste.de/t8kJ/raw The machine is running Apache 2.4 (with accf_http/accf_data loaded), PF, some webapps (ruby on rails, php-fpm, python, ...), .. Thanks, Julien -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. pgpM_n4tjGaNM.pgp Description: PGP signature ---End Message--- pgpoTU4RvrDuq.pgp Description: PGP signature
Re: [jci...@ulb.ac.be: Listen queue overflow: 8 already in queue awaiting acceptance]
On Thu, Oct 02, 2014 at 10:24:13AM -0700, hiren panchasara wrote:
On Thu, Oct 2, 2014 at 9:42 AM, Julien Cigar jci...@ulb.ac.be wrote:
sorry for cross-posting, I'm forwarding this as it seems that part of
the problem is also related to:
https://lists.freebsd.org/pipermail/freebsd-net/2014-September/039664.html
Umm, this looks like a different problem than the subject of this email.
yes and no, seems the same hardware (HP and igb) and I have also some
requests for mbufs denied (https://dpaste.de/t8kJ/raw) without any
reasons. I should add that the box hanged a week ago and I had to do a
hard reboot, I have the feeling that it's somewhat related to this
problem ..
I also wonder if something has been fixed in -STABLE in this area ..
(please keep me in CC as I'm not subscribed on freebsd-net@ an
freebsd-stable@)
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
-- Forwarded message --
From: Julien Cigar jci...@ulb.ac.be
To: freebsd-questi...@freebsd.org
Cc:
Date: Thu, 2 Oct 2014 11:52:06 +0200
Subject: Listen queue overflow: 8 already in queue awaiting acceptance
Hello,
I'm running 10-RELEASE on a HP Proliant DL160 Gen8 and I'm seeing the
following in my kernel logs:
sonewconn: pcb 0xf8010e561310: Listen queue overflow: 8 already in
queue awaiting acceptance
This usually means the application is not keeping up with the incoming
connections.
I already raised kern.ipc.soacceptqueue to 1024 and netstat -naA | grep
f8010e561310 returns nothing
This is the usual way of finding the culprit process. If this doesn't
return anything, it probably means that it is a short-lived process.
Here is an example of what you could do:
sonewconn: pcb 0xf8008f40cb10: Listen queue overflow: 1 already in queue
awaiting acceptance
From kgdb,
(kgdb) p ((struct inpcb *)0xf8008f40cb10)-inp_inc
$3 = {inc_flags = 0 '\0', inc_len = 0 '\0', inc_fibnum = 0, inc_ie = {ie_fport
= 0, ie_lport = 10295, ie_dependfaddr = {
ie46_foreign = {ia46_pad32 = {0, 0, 0}, ia46_addr4 = {s_addr = 0}},
ie6_foreign = {__u6_addr = {
__u6_addr8 = '\0' repeats 15 times, __u6_addr16 = {0, 0, 0, 0, 0,
0, 0, 0}, __u6_addr32 = {0, 0, 0, 0,
ie_dependladdr = {ie46_local = {ia46_pad32 = {0, 0, 0}, ia46_addr4 =
{s_addr = 0}}, ie6_local = {__u6_addr = {
__u6_addr8 = '\0' repeats 15 times, __u6_addr16 = {0, 0, 0, 0, 0,
0, 0, 0}, __u6_addr32 = {0, 0, 0, 0}}
Here, ie_lport = 10295 which is in n/w byte order and converting it to host
byte order, 10295 - 0x2837 and swapping them gives us 0x3728 which is 14120.
Now, use sockstat to find out what process is on that port:
$ sockstat -l | grep 14120
cheers,
Hiren
--
Julien Cigar
Belgian Biodiversity Platform (http://www.biodiversity.be)
PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0
No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced.
pgpPfTZpluYrZ.pgp
Description: PGP signature
Re: [jci...@ulb.ac.be: Listen queue overflow: 8 already in queue awaiting acceptance]
On Thu, Oct 02, 2014 at 01:21:32PM -0400, Brandon Allbery wrote: On Thu, Oct 2, 2014 at 12:42 PM, Julien Cigar jci...@ulb.ac.be wrote: sonewconn: pcb 0xf8010e561310: Listen queue overflow: 8 already in queue awaiting acceptance My immediate reaction is to find out which program is listening on that socket, and that it doesn't have listen(s, 8); in its code somewhere. I tried, but, apparently, the socket is only present a fraction of seconds in netstat -naA output .. so an attempt of netstat -naA | grep f8010e561310 returns nothing (note that it's not always the same socket: sonewconn: pcb 0xf8010e561310: Listen queue overflow: 8 already in queue awaiting acceptance sonewconn: pcb 0xf80b34faec40: Listen queue overflow: 8 already in queue awaiting acceptance etc -- brandon s allbery kf8nh sine nomine associates allber...@gmail.com ballb...@sinenomine.net unix, openafs, kerberos, infrastructure, xmonadhttp://sinenomine.net -- Julien Cigar Belgian Biodiversity Platform (http://www.biodiversity.be) PGP fingerprint: EEF9 F697 4B68 D275 7B11 6A25 B2BB 3710 A204 23C0 No trees were killed in the creation of this message. However, many electrons were terribly inconvenienced. pgpmWfNvKZBlF.pgp Description: PGP signature
