dummynet dropping too many packets

[rihad]

Luigi Rizzo wrote:
> On Tue, Oct 06, 2009 at 02:34:32PM +0500, rihad wrote:
>> Luigi Rizzo wrote:

>> 8664 output packets dropped due to no bufs, etc.
>> net.inet.ip.dummynet.io_pkt_drop: 111
> 
> io_pkt_drop only reports packets dropped to errors (missing pipes,
> randomly forced packet drops which you don't use, no buffers and so on).
> 
> The packets intentionally dropped in dummynet because queues are full
> are listed by 'ipfw pipe show'.
> 
> Even if pipes expire, there is a difference between having partial
> information and completely ignoring what is available and claiming
> "it's plain useless".

Ok, without looking I can say: there _are_ always some users overrunning 
their queues that have non-zero Drp column in ipfw pipe show. But they 
are also there downloading like crazy when the number of online users is 
below 2000 or so, so how come that they're overrunning their share 
without getting reflected in the global netstat -s drop counter? There 
are 0 drops! netstat -s only starts growing when the number of online 
users exceeds 2000.

> 
> BTW at least while you try to debug the problem you can temporarily
> disable the pipe expire with 'sysctl net.inet.ip.dummynet.expire=0'
> and also you could poll the stats more frequently (say every 1-2-5 sec)
> to get a better idea of what happens.
> 
I've tried expire=0 for a while, too. No difference whatsoever.

> The one time you sent the 'pipe show' info there were clearly
> a few pipes with thousand packet drops -- as i said those are
> unavoidable and correspond to clients that systematically
> exceed their share (500k/1m as you set) e.g. because they are flooding
> the net with TCP SYN or UDP requests. This may be due to viruses,
> aggressive p2p, and so on. A single client can easily generate
> the extra 2000 packets per seconds that you are seeing.
> 

Only downloads (i.e. traffic arriving from the Net) crosses the PC at 
hand. What makes me think this is a global problem, is that the drops 
_never_ happen when the number of online users in IPFW tables is below 
2000 or so, no matter how high global traffic load is. Please see my 
previous email with ipfw rules.