On 16.05.2008, at 20:01, mtnbkr wrote:
> 3648 active
I can't really see anything out of the ordinary in your vmstat/ipfstat
output; however, given the strict ruleset that you described, I find
3648 active connections quite a lot. You could try "ipfstat -ls" to
see the full list of active connections - maybe you'll see something
odd there. Of course if you have lots of users it could also be quite
Well, I have to admit that I don't know what to suggest at this point.
If the problem is really related to some odd traffic that occurs only
once in a while and somehow messes up ipfilter, one way of hopefully
getting a bit closer to finding out what it is would be to capture all
traffic on the LAN interface of your m0n0wall. Wireshark has a ring
buffer feature that allows it to capture indefinitely while consuming
a fixed amount of disk space. Then when the problem occurs again, you
could correlate the time of the kernel panic with the traffic just
before it happened, and hopefully discovery something extraordinary.
It could be a lot of data to sift through, though...