This is my last post on this as we are drifting into the realms of network programming and OS tuning and far beyond the fringes of NANOG relevancy. On Wed, 11 Sep 1996, Noam Freedman wrote:
Avi's patches center around removing the limit on the size of the linked list. With ndd, you can only raise the limit to 1024. Thus, the main goal of Avi's patch is not possible.
Thats true. I was mainly trying to give those of us running a modern version of SunOS pointers on where to start.
On web servers, remote users routinely take longer than this to set up connections. Anything less than 15-20 seconds and you will start loosing hits from those ISP's that Metcalfe seems to frequent. This isn't a criticism of Avi's patch. Its just something to be aware of.
Agreed. I would say that a good realistic limit is 30. Anything below that and you WILL be kicking off valid connections. However, I would lower it as soon as I knew I was being attacked.
Yes, but this need to be pointed out so that you don't get people putting patches on for prevention and then wondering why they have other problems.
Someone needs to make similar modifications to Solaris to remove the artificial limit (assuming the Solaris implimentation does not have a hard limit (ie: based on something like an array instead of a linked list.)
I agree. The Solaris docs are very poor on the details of the TCP implementation. Even the catalyst/developper docs are contradictory about the tcp connection limits and such. I'm going to take a look at the src and see whats actually going on. I also want to check if the limits are a ndd thing. If so that can be gotten around using your friend adb. -chris
- Noam