Linux Netfilter discussions
 help / color / mirror / Atom feed
From: Bernhard Bock <mailinglists@bock.nu>
To: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: netfilter@vger.kernel.org
Subject: Re: conntrackd failover works partially, was Re: conntrack performance test results in INVALID packets
Date: Wed, 03 Sep 2008 13:26:53 +0200	[thread overview]
Message-ID: <48BE747D.3010106@bock.nu> (raw)
In-Reply-To: <48BE5547.8030505@netfilter.org>

Hi Pablo,

Pablo Neira Ayuso wrote:
>>> Is the firewall sending RST packets to the peer/server to close
>>> connections? If so, I remember a similar report with a RHEL kernel:

I do not see any RST packets, neither on server nor on client side.

I have done more tests this morning. Unfortunately, things are complicated:

I repeated a basic failover test lots of times while making 1.000.000
connections. This test with 1000 parallel connections breaks every time.
500 is OK every time.

The kernel only has problems with 1000 connections, and then only from
time to time. In most of the cases (I guess ca. 80% of all tests), I do
not need to unload/load the kernel modules, but only clear the conntrack
table to get it back up running. The other times I have to reload the
kernel modules in order to make the system work again. I cannot see any
pattern there.

Best regards
Bernhard

  reply	other threads:[~2008-09-03 11:26 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-07-18  9:39 conntrack performance test results in INVALID packets Bernhard Bock
2008-07-18 10:13 ` Jan Engelhardt
2008-07-18 10:52   ` Bernhard Bock
2008-07-18 12:14     ` Pablo Neira Ayuso
2008-07-18 14:20       ` conntrackd failover works partially, was " Bernhard Bock
2008-07-21  0:37         ` Pablo Neira Ayuso
2008-07-21 14:22           ` conntrackd failover works partially Bernhard Bock
2008-07-23  8:51             ` Bernhard Bock
2008-07-23 12:50             ` Pablo Neira Ayuso
2008-07-23 15:20               ` Bernhard Bock
2008-08-08  8:47         ` conntrackd failover works partially, was Re: conntrack performance test results in INVALID packets Pablo Neira Ayuso
2008-08-08 12:58           ` Bernhard Bock
2008-09-02  9:39           ` Bernhard Bock
2008-09-02  9:56             ` Pablo Neira Ayuso
2008-09-02 12:34               ` Bernhard Bock
2008-09-02 12:48                 ` Pablo Neira Ayuso
2008-09-02 15:18                   ` Bernhard Bock
2008-09-02 16:22                     ` Pablo Neira Ayuso
2008-09-02 16:55                       ` Bernhard Bock
2008-09-03  9:13                         ` Pablo Neira Ayuso
2008-09-03 11:26                           ` Bernhard Bock [this message]
2008-09-04 12:29                             ` Pablo Neira Ayuso
2008-09-04 13:27                               ` Bernhard Bock
2008-09-05 10:55                                 ` Pablo Neira Ayuso
2008-09-04 11:40                 ` Pablo Neira Ayuso

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=48BE747D.3010106@bock.nu \
    --to=mailinglists@bock.nu \
    --cc=netfilter@vger.kernel.org \
    --cc=pablo@netfilter.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox