Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-13 Thread Claudio Jeker
On Sat, Sep 11, 2010 at 09:27:51AM -0600, Andy Bradford wrote: Thus said Claudio Jeker on Sat, 11 Sep 2010 11:28:31 +0200: Wrong UDP is normaly not a fully defined 4 touple. Especially the listening sockets (on port 53) can be slammed with packets. On the other hand, if the

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-12 Thread Henning Brauer
* Martin Pelikan martin.peli...@gmail.com [2010-09-09 12:24]: It depends on what do you need. The defaults suffice for most cases, but on our most loaded router we use tcp both 256k and udp send space which is bullshit on a router, since rcv/send space is for sockets and irrelevant for

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-11 Thread Claudio Jeker
On Fri, Sep 10, 2010 at 08:20:30PM -0600, Andy Bradford wrote: Thus said Claudio Jeker on Fri, 10 Sep 2010 21:36:16 +0200: Because on busy servers you need to queue quite a few packets to handle bursts. I was under the impression that UDP is connectionless and therefore does

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-11 Thread Andy Bradford
Thus said Claudio Jeker on Sat, 11 Sep 2010 11:28:31 +0200: Wrong UDP is normaly not a fully defined 4 touple. Especially the listening sockets (on port 53) can be slammed with packets. On the other hand, if the recvbuffer overflows then packets just get dropped. Thank you for the

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Martin Pelikán
2010/9/10, Stuart Henderson s...@spacehopper.org: these affect traffic sourced from the box itself, *not* routed through it. We had to do quite extensive link testing because of strange packet loss on the SDH circuit. The buffer sizes really mattered :-) But thanks to the information as the link

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Andy Bradford
Thus said =?UTF-8?Q?Martin_Pelik=C3=A1n?= on Thu, 09 Sep 2010 12:21:17 +0200: It depends on what do you need. The defaults suffice for most cases, but on our most loaded router we use tcp both 256k and udp send space 65k (lots of dns). Just test it somewhere. Why would you need 65k UDP

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Martin Pelikán
2010/9/10, Andy Bradford amb-sendok-1286721307.iadidoklmfcciicnc...@bradfords.org: Why would you need 65k UDP for DNS? Almost all UDP based DNS responses are under 512 bytes, those that are larger are required to set the truncated bit and the client restart the query using TCP. We have

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Claudio Jeker
On Fri, Sep 10, 2010 at 08:35:04AM -0600, Andy Bradford wrote: Thus said =?UTF-8?Q?Martin_Pelik=C3=A1n?= on Thu, 09 Sep 2010 12:21:17 +0200: It depends on what do you need. The defaults suffice for most cases, but on our most loaded router we use tcp both 256k and udp send space 65k

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Chris Cappuccio
Martin Pelik??n [martin.peli...@gmail.com] wrote: 2010/9/10, Andy Bradford amb-sendok-1286721307.iadidoklmfcciicnc...@bradfords.org: Why would you need 65k UDP for DNS? Almost all UDP based DNS responses are under 512 bytes, those that are larger are required to set the truncated

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Martin Pelikán
2010/9/10, Chris Cappuccio ch...@nmedia.net: Stop using ALTQ on your DNS server, perhaps? That may be what is causing the back-pressure that you're seeing. Why do you think it would help? Those lots of packets would arrive anyway, only the decent user will wait longer for his website to load.

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Chris Cappuccio
Martin Pelik??n [martin.peli...@gmail.com] wrote: 2010/9/10, Chris Cappuccio ch...@nmedia.net: Stop using ALTQ on your DNS server, perhaps? That may be what is causing the back-pressure that you're seeing. Why do you think it would help? Those lots of packets would arrive anyway, only

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-10 Thread Andy Bradford
Thus said Claudio Jeker on Fri, 10 Sep 2010 21:36:16 +0200: Because on busy servers you need to queue quite a few packets to handle bursts. I was under the impression that UDP is connectionless and therefore does not behave the same as a TCP connection. I would guess that

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-09 Thread Martin Pelikán
2010/9/8, Joe Warren-Meeks joe.warren.me...@gmail.com: I've had a weird problem happen twice now. It seems after about 4 - 6 weeks of running very happily, both servers lock up completely at the same time. Both consoles show no error messages, but the cursor is blinking away happily. Neither

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-09 Thread Joe Warren-Meeks
2010/9/9 Martin Pelikan martin.peli...@gmail.com: Hello Martin, I thought the same when I played with TCP buffers set to 1M and after some heavy load tests I went out of RAM quite soon :-) The machine had 2G. Well, the machine has 6Gb of RAM and is only pushing 10Mbit/s of traffic at peak.

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-09 Thread Martin Pelikán
2010/9/9, Joe Warren-Meeks joe.warren.me...@gmail.com: Well, the machine has 6Gb of RAM and is only pushing 10Mbit/s of traffic at peak. It does need to maintain a largeish state table, as it is predominatly web traffic, but I've run much much larger and busier sites behind much smaller

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-09 Thread Nick Gustas
Joe Warren-Meeks wrote: Hey guys, I'm running two HPDL360 G5 servers with OpenBSD 4.6+carp+pf+pfsync as an active/passive firewall pair. Both are running: (full dmesg at bottom, along with edited pf.conf, in case it's relevant) j...@f2:/home/joe uname -a OpenBSD f2 4.6 GENERIC.MP#81 amd64

Re: OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-09 Thread Stuart Henderson
On 2010-09-09, Martin Pelik??n martin.peli...@gmail.com wrote: 2010/9/9, Joe Warren-Meeks joe.warren.me...@gmail.com: recv/send: net.inet.tcp.recvspace=16384 net.inet.udp.recvspace=41600 j...@f1:/home/joe sysctl -a |grep send net.inet.tcp.sendspace=16384 net.inet.udp.sendspace=9216 Too

OpenBSD 4.6 + carp + pf + pfsync lockup

2010-09-08 Thread Joe Warren-Meeks
Hey guys, I'm running two HPDL360 G5 servers with OpenBSD 4.6+carp+pf+pfsync as an active/passive firewall pair. Both are running: (full dmesg at bottom, along with edited pf.conf, in case it's relevant) j...@f2:/home/joe uname -a OpenBSD f2 4.6 GENERIC.MP#81 amd64 I've had a weird problem