|
One idea that comes to mind:
Check your IP tables rules and make sure you are not tossing some of the
new connection requests. Its not uncommon to stick a rule in that
limits the rate of new connection requests as a simple SYN flood / DoS
prevention measure. If you are sloppy with this as your traffic load
increases you'd see symptoms like those you described.
On Fri, 2006-06-02 at 10:59 -0400, Jacob Coby wrote:
> Hi all,
>
> I just upgraded my real servers from redhat 7.3 to centos 4.2. When I
> do a 'tcpdump port 80', I get large numbers of dropped packets. Is this
> normal? My users are complaining about random 'server cannot be found'
> errors. Refreshing the page a couple of times seems to fix it for a
> little while.
>
> Sample output on the real server:
>
> 1761 packets captured
> 2045 packets received by filter
> 170 packets dropped by kernel
>
> I've seen it as high as 80% of the packets dropped by the kernel.
> ifconfig looks like:
>
> eth0 Link encap:Ethernet HWaddr 00:0F:1F:64:83:0A
> inet addr: Bcast: Mask:255.255.255.0
> inet6 addr: fe80::20f:1fff:fe64:830a/64 Scope:Link
> UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
> RX packets:56762863 errors:0 dropped:0 overruns:0 frame:0
> TX packets:52368295 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:1000
> RX bytes:1314052482 (1.2 GiB) TX bytes:2879436004 (2.6 GiB)
> Interrupt:193
>
> lo Link encap:Local Loopback
> inet addr:127.0.0.1 Mask:255.0.0.0
> inet6 addr: ::1/128 Scope:Host
> UP LOOPBACK RUNNING NOARP MTU:16436 Metric:1
> RX packets:204 errors:0 dropped:0 overruns:0 frame:0
> TX packets:204 errors:0 dropped:0 overruns:0 carrier:0
> collisions:0 txqueuelen:0
> RX bytes:983393 (960.3 KiB) TX bytes:983393 (960.3 KiB)
>
> lo:1 Link encap:Local Loopback
> inet addr:VIP1 Mask:255.255.255.255
> UP LOOPBACK RUNNING NOARP MTU:16436 Metric:1
>
> lo:2 Link encap:Local Loopback
> inet addr:VIP2 Mask:255.255.255.255
> UP LOOPBACK RUNNING NOARP MTU:16436 Metric:1
>
> ifcfg-lo:1 looks like:
>
> DEVICE=lo:1
> IPADDR=VIP
> NETMASK=255.255.255.255
> NETWORK=<netmask>
> ONBOOT=yes
> ARP=no
>
> /etc/sysctl.conf has:
> net.ipv4.conf.lo.arp_ignore = 1
> net.ipv4.conf.lo.arp_announce = 2
> net.ipv4.conf.all.arp_ignore = 1
> net.ipv4.conf.all.arp_announce = 2
>
> I'm running LVS-DR.
>
> Are dropped packets normal now? I never had them when running on redhat
> 7.3. I've checked the DNS servers, and they seem to always respond
> correctly, so I can only assume it has something to do with these
> dropped packets or some other configuration error.
>
|
