> On 13 Jan 2026, at 15:37, Stuart Henderson <[email protected]> wrote:
>
> two quick things I would try to see if behaviour changes:
>
> - temporarily disabling wg
> - sysctl net.inet.tcp.tso=0
>
I destroyed the wg0 interface and disabled TSO but neither has slowed the rate.
> you could also collect netstat -ss at a minute apart and diff the two,
> see if any unexpected counters are increasing at a similar rate
Checked both netstat -ss and pfctl -s info to see if there were any counters
incrementing at the same or similar rate but there was not anything obviously
moving at the same rate or that looked unexpected.
Trying to think about what else is a bit odd on the network and we do have
one misbehaving corporate Windows 11 device that keeps coming for a DHCPREQUEST
every 5 minutes or so, but the timing is off on that and the mbuf increases so
I feel like that is just clutching at straws.
I guess I could try turning off PF entirely, that would show if it was a PF rule
that is causing the allocations?
