Re: Abnormal network errors?

From: Charles Swiger (cswiger_at_mac.com)
Date: 05/05/04

  • Next message: adp: "Re: Abnormal network errors?" 
    Date: Wed, 5 May 2004 15:33:46 -0400
To: adp <dap99@i-55.com>

    On May 5, 2004, at 2:27 PM, adp wrote:
    > On this server I'm thinking I need two things:
    >
    > 1. More sockets available.
    > 2. Larger sockbufs for send and recv.
    >
    > Is this an accurate assessment?

    Given the application of this system, you might want to up the value of
    kern.ipc.nmbclusters by a factor of four or so (it's NBMCLUSTERS in the
    kernel config file). However, it's not essential-- your "netstat -m"
    is OK, and your TCP send and receive windows are reasonably sized as-is
    by default.

    > What is "2432320 packets for unknown/unsupported protocol"? What
    > specifically does this mean? (In other words, what should I do to
    > resolve
    > this?)

    It means machines are sending non-IP traffic on your network, which is
    normal if you have Windows protocols (NetBEUI, SPX/IPX) or Macs
    (AppleTalk) around. Or chatty network devices like some printers....

    See /usr/include/net/ethernet.h for an idea, or maybe "tcpdump not ip"
    might give some idea of what's going by.

    > What about "921363 calls to icmp_error"?

    ICMP messages like responding to a ping, or people sending traffic with
    RFC-1918 unroutable addresses (gives "dest unreachable")...

    > Under tcp I have "481930 embryonic connections dropped". I assume that
    > means
    > I don't have enough sockets available for when this server gets loaded.
    > Correct?

    More likely, these are someone doing a port scan and leaving half-open
    connections lying around to get cleaned up.

            ----

    It might be helpful if you gave us some idea as to what the performance
    problem you were seeing was? Is NFS access slow, or some such? Are
    you seeing errors or collisions in netstat -i or in whatever statistics
    your switch keeps per port?

    The following areas struck me as being relevant:

    > # ifconfig rl0

    First, consider upgrading to a fxp or dc-based NIC.

    > udp:
    > 272987897 datagrams received
    > [ ... ]
    > 19976574 dropped due to full socket buffers

    This is high enough to represent a concern, agreed.

    > ip:
    > 578001924 total packets received
    [ ... ]
    > 4899083 fragments received
    > 4 fragments dropped (dup or out of space)
    > 750 fragments dropped after timeout
    > 842689 packets reassembled ok
    [ ... ]
    > 609745425 packets sent from this host
    > 1914687 output datagrams fragmented
    > 10496350 fragments created

    Second, you're fragmenting a relatively large number of packets going
    by, you ought to see what's going on with your MTU and pMTU discovery.
    I suppose if you're using large UDP datagrams with NFS, that might be
    it.

    [ The machines I've got around with comparible traffic volume might
    have 400 frags received, and 10 transmitted, or some such. ] 

    -- 
-Chuck
_______________________________________________
freebsd-performance@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-performance
To unsubscribe, send any mail to "freebsd-performance-unsubscribe@freebsd.org"
  • Next message: adp: "Re: Abnormal network errors?"

    Relevant Pages

    • Re: Abnormal network errors?
      ... More sockets available. ... > I don't have enough sockets available for when this server gets loaded. ... Is NFS access slow, or some such? ... you seeing errors or collisions in netstat -i or in whatever statistics ...
      (freebsd-questions)
    • Example: Socket code (Was Re: ClientServer App)
      ... protocol, such as HTTP, as your application middleware backbone?". ... control of the server with Flash Data Management Services?" ... just enter an asterix "*" for the Queue Name and then click ... thought was to use sockets with xml-rpc but then thought there has to ...
      (comp.lang.java.programmer)
    • Re: Asynchronous socket programming vs. remoting
      ... You are the first person that said I should use sockets. ... them quicker than I can load them from my harddrive using the file system. ... It scales nice too - I tried throwing 400 requests at the server in a span ... > do not need the same assembly on the client and server. ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: sockets and pipes....
      ... > I have a master process that communicates with a whole bunch of hardware ... > I've been playing with named pipes and sockets but I can't help but think ... What we did was to have an instance of a process called an Interface Server ... I would have a process waiting for each sensor (and perhaps ...
      (comp.os.linux.misc)
    • Re: sockets and pipes....
      ... > I have a master process that communicates with a whole bunch of hardware ... > I've been playing with named pipes and sockets but I can't help but think ... What we did was to have an instance of a process called an Interface Server ... I would have a process waiting for each sensor (and perhaps ...
      (comp.os.linux.development.system)