June 2005 - tproxy - lists.balabit.hu

re: Conntrack entries not decreasing
by Mohammed Riyaz 24 Jun '05

24 Jun '05

Hi, >Do you have any patches applied on 2.6.10 apart from tproxy? Vanilla >2.6.10 had a TCP connection tracking bug which caused some TCP >connections linger in the conntrack table for way too much time. Please >take a look at the original tproxy for 2.6.10 announcement in the >mailing list archives: >https://lists.balabit.hu/pipermail/tproxy/2005-February/000171.html I hadnt applied the patch you mentioned. I will try this patch and i hope that solves the problems. >lthough this value depends on your traffic pattern, I'd say 32000 is > bit too low for a dedicated squid proxy. With 512MB RAM you could >afely set that to a higher value (64k for example). and i would experiment with this too :) Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - mmm... Fastmail...

1 0

reg nat reservations
by Mohammed Riyaz 24 Jun '05

24 Jun '05

Hi, I was looking through the archives when i came across this - " NAT reservations make it possible for tproxy to fail early. If NAT reservations are enabled, tproxy registers "reservations" for foreign addresses to be used later. If such a registration fails, that means that the foreign address is already reserved for some other connection. This is why in that case even the setsockopt() call fails. This is good, since it provides you a way of detecting the error. " While i patched the kernel i applied all the four patched provided, which includes the patch for nat reservations. After reading the above paragraph, i am totally confused. Could you pl. tell when the nat reservations patch needs to be applied. I am mainly using tproxy for squid. So would nat reservations be required in this case. Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - A no graphics, no pop-ups email service

1 0

tproxy 2.6.10+
by Pásztor Lénárd Zoltán 22 Jun '05

22 Jun '05

Sziasztok! Esetleg meg tudja nekem valaki mondani mikorra varhato tproxy patch frissites? Sajnos csak 2.6.10-es patch-et talaltam de (az xen 2.0.6 miatt) nekem legalabb 2.6.11-es kernelen kene hogy mukodjon. Sajnos nem vagyok toppon C-ben igy magam nem tudom megoldani a conflict-okat. :( Esetleg latott / hallott mar valaki magasabb verzio szamu tproxy patch-rol? URL? Jol gondolom, hogy ha nekem adott 1 szolgaltatas IP es belul tobb webszerver amelyek kulonbozo domaineket szolgalnak ki es szuksegem van az eredeti kliens IP-kre az access.log-okban akkor zorp+tproxy+iptables megoldasra van szuksegem? udv, Lenard

1 0

Conntrack entries not decreasing
by Mohammed Riyaz 21 Jun '05

21 Jun '05

Hi, I am using squid (tproxy patched) on 2.6.10 (tproxy patched). The box crashed after a week of starting it, with kernel panic. I have been monitoring the box since then , and the conntrack entries are always increasing gradually. It does decrease now and then by a marginal amount. The number of entries dosent seem to decrease every during the night when there is hardly any usage. Is the is bug in tproxy patch or is this expected behavior?? If this is expected, then could some one suggest alternatives to reduce the conntrack entries to prevent server from crashing?? Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - Same, same, but different

2 3

Kernel upgrade
by Jan Engelhardt 20 Jun '05

20 Jun '05

Hello, could the tproxy developers provide a patch against 2.6.11 or .12? The 2.6.10/patch_tree/01-nat_reservations.diff does not apply very well on .11 because of changes in the expect* functions, and I got almost no clue how to fix it (_and_ have it work afterwards ;) Thank you, Jan Engelhardt -- | Gesellschaft fuer Wissenschaftliche Datenverarbeitung Goettingen, | Am Fassberg, 37077 Goettingen, www.gwdg.de

2 6