Re: PF Problems

["Brian A. Seklecki" <seklecki%noc.cfi.pgh.pa.us@localhost>]

On Fri, 2009-07-17 at 09:36 -0500, Steve Pribyl wrote:
> Patrick,
> 
> Thanks for responding.  I will start watching this.

% pfctl -x loud or % pfctl -s misc 
  ... when it gets slow

Also, the defaults are a bit low for HPC environments.  Try:

  # Sanitize incoming traffic (All PIX sanitization is disabled)
  set optimization aggressive
  
  set limit  { states 200000, frags 200000, src-nodes 200000,\
  table-entries 200000}

  scrub on $if_ext all fragment reassemble

"netstat -s" and "netstat -m" when it becomes slow, as well.

~BAS