Re: [LARTC] sfq, queue len and dropped packets

[Mihai RUSU <dizzy@roedu.net>]

On Wed, 10 Apr 2002, Don Cohen wrote:

> First, are you sure you're not under attack?

Well, there many computers behind that class and we get a lot of flood
attacks each day, so there is no way to tell for sure if in that moment
there is an attack or not.

> If you are running a small network this seems implausible.

Its not small at all, several hundred of computers.

> Also, the constant high backlog probably indicates that you're
> just getting input faster than you can forward it.  In that case
> increasing the queue length won't result in many fewer drops.
> It will just increase average delay.
>

I see. What exactly do you mean with getting input faster than output? I
mean the SFQ class is on a CBQ which limits them already, do you mean that
even so the kernel tries to enqueue() more packets than the system (SFQ)
can deal with?

In that case I would have to see a high load on that computer but the load
its lower than 0.5 usually.

> This tells how to decrease, not increase the limit (and the
> explanation of why you'd want to makes no sense to me).
> In order to increase the limit you have to not only increase
> the queue "depth", but also change a type declaration, something
> like sfq_index - from char to int.  There's a comment about that
> in the code.

I usually dont have problems hacking into C programms but I dont get it
what does that comment means, with the 4k page limit. I mean I need a
formula to calculate to see if I would get over that 4k limit.

Thanks for the answer

----------------------------
Mihai RUSU

Disclaimer: Any views or opinions presented within this e-mail are solely
those of the author and do not necessarily represent those of any company,
unless otherwise specifically stated.

_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/