Monday, June 04, 2018

Re: NTP client traffic from WAN causing LAN DoS?

On 2018-06-04, Stuart Longland <stuartl@longlandclan.id.au> wrote:
> My thinking, since the problem has disappeared, is that the sheer number
> of clients was overwhelming the router, and as a result, it didn't have
> enough buffer space to handle the number of separate hosts requesting
> the time from it.

Oh! It might have been PF state table exhaustion. By default a maximum
of 10000 states are allowed (can be overridden with a different value in
pf.conf).

Has it been rebooted since the last time you saw the problem? If not,
pfctl -si might still have some clues in the counters.

No comments:

Post a Comment