Re: PF and stalled connections

[Olaf Schreck <chakl_(_at_)_syscall_(_dot_)_de>]

> All type of sessions - I first picked it up when one the users was playing 
> counterstrike online and complained of periodic pauses. I ignored him of 
> course, until I noticed the same problem when I was ssh'ing to an external 
> host. And it's also evident with pop and http.

Hmm, reminds me of an incident with 2.9 and pf's predecessor..  Have you 
checked how many connections/states actually go through the firewall? 

We saw the very same symptoms, flaky ssh, users complaining about failed 
http/pop, 15-30% packet loss on the external interface.  There were ~1000 
active states from and to the counterstrike port range, stuffing the pipe 
and resulting in dropped packets.  [you already guess, a /29 netblock 
allocated to a teenager, and pass all rules as requested by customer 
policy :]

Some game geek said it didn't look like normal game traffic, so we 
suspected file sharing stuff masquerading over counterstrike ports.  
Customer shut down the offending systems, flush states on the firewall, 
back to normal operation..


ciao,
chakl