Below is the output on 4.1.28. In this case my statemax is 7000 and you
are right, it was at the default before and it's dumping the active
states when it hits the defined maximum. What is TCP State 10? Is that
TIME_WAIT? My tests in 4.1.28 now eventually have the states clearing
but only after 4 minutes. Maybe before I wasn't patient enough and it's
possible the only trials where I let it go for a long time where with
older versions. If it is just in TIME_WAIT, then is that time setable?
The host is set to only keep it in TIME_WAIT for 60 seconds. Even so,
is there a way to make the (limit X) option in ipf.conf only count
against connections in the ESTABLISHED state or just not include
TIME_WAIT? Otherwise, it's still not really counting X concurrent
connections as much as X connections per TIME_WAIT period? In my case,
we would be getting a lot of connections in quick succession, but I want
to limit the number of connections being made at simultaneously. That
make sense? Thanks for your help.
dr2 ~> ipfstat -s
IP states added:
9002 TCP
1 UDP
0 ICMP
90570 hits
9007 misses
0 bucket full
0 maximum rule references
1 maximum
0 no memory
4690 bkts in use
7000 active
1 expired
2002 closed
State logging enabled
State table bucket statistics:
4690 in use
67% hash efficiency
46.86% bucket usage
0 minimal length
7 maximal length
1.493 average length
TCP Entries per state
0 1 2 3 4 5 6 7 8 9 10 11
0 0 0 0 1 0 0 0 0 0 6999 0
Darren Reed wrote:
Jeff Durand wrote:
...
dr2 ~/ipf> ipfstat -s
IP states added:
...
3 maximum
..
dr2 ~/ipf> ipfstat -s
IP states added:
...
4 maximum
...
The default maximum is only 4013, and your tests show "3924" is
reached....
The only way the above counter gets bumped is when it reaches the maximum
number of entries allowed in the table. What do you think you've
defined the
table maximum to be?
btw, can you please include the output from 4.1.28? It has some extra
information
that I'm curious about...
Thanks,
Darren
