Re: timeout storms make the box unresponsive

[Harald Welte <laforge@netfilter.org>]

[-- Attachment #1: Type: text/plain, Size: 1581 bytes --]

On Fri, Jul 25, 2003 at 08:56:44PM +0200, Balazs Scheidler wrote:

> Maybe we should consider removing expired entries from the NAT hash at a
> single go, instead of the current lock-remove-unlock for each entry. Or
> create a cleanup thread which cleans up conntrack entries regularly, but not
> in the timer interrupt context.

Rusty, Jamal and I were talking about this conntrack cleanup yesterday
(we're currently all at OLS).  The conclusion was that a cleanup kernel thread 
is what we want to have.

This can be combined with the ip_conntrack timer change.  Instead of
resetting the timer inside struct ip_conntrack every time, we just write
jiffies+timeout into a field.  

And then there is a kernel thread that cleans up all expired entries in
regular intervals.

If I understood correctly, Rusty already has some old patches in this
area, and he is most likely to put an update of these patches out in the
next weeks before the netfilter developer workshop.

If this is too late and somebody else wants to work on this, please
coordinate with Rusty to not duplicate any work.  

> Bazsi
> PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
> 

-- 
- Harald Welte <laforge@netfilter.org>             http://www.netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]