Re: "No buffer space available" upon ipq_read

[Pablo Neira <pablo@eurodev.net>]

Christian Riechmann wrote:

>	Which buffer is meant ? 
>  
>

there's a buffer in kernel space, if I remember well, when it gets full 
the socket flag overrun is set, that's why you get that error when you 
try to read() in user space.

>and
>	Which are some reasons for this error situation ?
>  
>

kernel has sent more messages than it can storage in the buffer.

>I use iptables- 1.2.9 and I am pretty sure, that all packets read into
>user space are verdicted. The user space program does not expand its used
>memory the more it runs.
>  
>

This is netlink related, note that libipq is built on top of netlink 
sockets so it inherits this limitation.

you could fix that setting a bigger buffer via sysctl:

echo 524280 > /proc/sys/net/core/rmem_default
echo 524280 > /proc/sys/net/core/rmem_max
echo 524280 > /proc/sys/net/core/wmem_default
echo 524280 > /proc/sys/net/core/wmem_max

regards,
Pablo