ipf FIN_WAIT_1太多

canjie

FREEBSD 7.2  使用的是ipfilter， nginx（大量小图片请求）
目前设置

net.inet.tcp.always_keepalive=0

启用ipf的时候FIN_WAIT_1和FIN_WAIT_2都会升高。而且流量就下降。

nginx的设置

tcp_nopush     on;
keepalive_timeout 10;
tcp_nodelay on;

FIN_WAIT_2 3366
FIN_WAIT_1 1602

请问是不是ipf的设置问题。

pass in quick on lo0 all
pass out quick on lo0 all
pass out quick on em0 proto tcp/udp from any to any keep state
pass in quick on em0 from xxx.xxx.xxx.xxx to any
pass in quick on em0 proto tcp from any to any port = 80 flags S keep state
pass out quick on em0 proto tcp from any to any port = 53 flags S keep state
pass out quick on em0 proto tcp from any to any port = 80 flags S keep state
pass out quick on em0 proto tcp from any to any port = 21 flags S keep state
pass out quick on em0 proto tcp from any to any port = 443 flags S keep state
pass out quick on em0 proto tcp from any to any port = 110 flags S keep state
pass out quick on em0 proto tcp from any to any port = 25 flags S keep state
pass out quick on em0 proto udp from any to any port = 53 keep state
pass out quick on em0 proto udp from any to any port = 123 keep state
pass out quick on em0 proto tcp from any to any port = 123 flags S keep state
pass out all
block in quick all

canjie

大家帮帮忙啊，可能是某些ack fin的包被挡住了。帮忙看一下上面有没有错

qq830406

关注

pf rdr,一样大量fin,调了半天也没什么效果,但似乎也没影响到什么

canjie

我这边还是有影响的，网络流量会下降。

lsstarboy

调整一下
net.inet.tcp.msl
试试，默认是7500，改为2500。

canjie

原帖由 lsstarboy 于 2009-5-31 07:59 发表
调整一下
net.inet.tcp.msl
试试，默认是7500，改为2500。

这个有设置过，不过我觉得应该是某些包被挡住的了。开启ipf的时候，ipfstat，input blocked不断的在增加。上面的ipf规则会不会有错？