Solaris IPFilter optimization

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)
Loading...

The default settings are quite conservative, and should be increased.

user@opensolaris:~# ipfstat | grep lost
fragment state(in):     kept 0  lost 0  not fragmented 0
fragment state(out):    kept 0  lost 0  not fragmented 0
packet state(in):       kept 798        lost 100
packet state(out):      kept 612        lost 234

The default settings are quite conservative.

user@opensolaris:~# ipf -T list | grep fr_state
fr_statemax min 0×1 max 0x7fffffff current 4096
fr_statesize min 0×1 max 0x7fffffff current 5002

You need to shutdown IPFilter and apply larger table size limits.

user@opensolaris:~# svcadm disable ipfilter
user@opensolaris:~# /usr/sbin/ipf -T fr_statemax=18963,fr_statesize=27091

To make this persistent across reboots edit ipf.conf

user@opensolaris:~# vi /usr/kernel/drv/ipf.conf
name=”ipf” parent=”pseudo” instance=0 fr_statemax=18963 fr_statesize=27091;

Check again to see if the change took effect.

Leave a Reply

avatar
3000
  Subscribe  
Notify of