Apparent Memory Leak

Apparent Memory Leak

[Del Winiecki]

Hi,
My Linux router using DNAT/SNAT/mangle etc, all works as expected, but
am seeing what appears to be a memory leak. As traffic increases,
available ram disappears and never returns. Eventually it begins to page
applications to disk, and then I have to reboot it. With no network
traffic, used memory is static.
I see a bug at RedHat where someone else had the exact same problem.
Does anyone know of any memory de-allocation problems at the net buffer
level?
This router handles internet traffic for 2 isp's and 7 company LAN's, so
moderately complex iptables setup, tbf rate management for some.

IPTABLES version 1.2.5
RedHat kernel 2.4.18-24.7.x  for i686 
running on an intel pentium 4 - 2.4ghz, ASUS P4B533 motherboard with
1gbyte ram.(5) 3com 3c905ctx nic cards, (1) Sangoma T1 WAN card.

The problem occurs with or without the Sangoma card present in the
system.

Regards,
Del W.

Re: Apparent Memory Leak

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 1583 bytes --]

On Wed, Mar 05, 2003 at 01:11:00PM -0700, Del Winiecki wrote:
> Hi,
> My Linux router using DNAT/SNAT/mangle etc, all works as expected, but
> am seeing what appears to be a memory leak. As traffic increases,
> available ram disappears and never returns. Eventually it begins to page
> applications to disk, and then I have to reboot it. With no network
> traffic, used memory is static.
> I see a bug at RedHat where someone else had the exact same problem.
> Does anyone know of any memory de-allocation problems at the net buffer
> level?

No, we are not aware of such issue.  And there are in fact lots of
people (with large setups, even at universities) using
netfilter/iptables...

... so if there really is a memory leak, there has to be something
specific about your setup.

> This router handles internet traffic for 2 isp's and 7 company LAN's, so
> moderately complex iptables setup, tbf rate management for some.

2 isp's... but you don't do asymmetric routing?

what is the average number of conntrack entries you have?
does the number of conntrack entries also grow and never shrink?
does /proc/net/ip_conntrack show lots of UNCONFIRMED entries?

> Regards,
> Del W.

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]