Hi list, i have a problem with a computer running OpenBSD 3.7 and performing IDS-tasks. The computer receives approximately 200Gb/day of traffic. I've created 128 bpf devices in /dev. The symptom is that software which wants to open a bpf device fails. The following commands illustrate this:
# fstat | grep bpf Shows that bpf device 0 through 36 are in use, this is ok because i have the same number of programs listening on a bpf device. # ktrace tcpdump -c 1 -ni bridge0 .. creates a dump file # kdump | grep bpf .. shows that the frist available bpf device is bpf119 # kdump | less 12638 tcpdump CALL open(0xcfbfb150,0,0x3c001259) 12638 tcpdump NAMI "/dev/bpf115" 12638 tcpdump RET open -1 errno 16 Device busy 12638 tcpdump CALL open(0xcfbfb150,0,0x3c001259) 12638 tcpdump NAMI "/dev/bpf116" 12638 tcpdump RET open -1 errno 16 Device busy 12638 tcpdump CALL open(0xcfbfb150,0,0x3c001259) 12638 tcpdump NAMI "/dev/bpf117" 12638 tcpdump RET open -1 errno 16 Device busy 12638 tcpdump CALL open(0xcfbfb150,0,0x3c001259) 12638 tcpdump NAMI "/dev/bpf118" 12638 tcpdump RET open -1 errno 16 Device busy 12638 tcpdump CALL open(0xcfbfb150,0,0x3c001259) 12638 tcpdump NAMI "/dev/bpf119" 12638 tcpdump RET open 4 Is this a known bug in OBSD3.7 under load not to release bpf devices or is there another probable cause?? with regards Joost
