Hi Dimitri, Dimitri GOURDON wrote:
A lot of TCP packets with FIN or RST flags (all I think) from clients are dropped by Iptables as state INVALID. The consequence is that I have a lot of connection in FIN_WAIT state (shown by netstat) on the 2 web servers...
[...]
Is someone can help me ???
Sounds a bit like the problem I've asked about a few days ago. Try to increase the hashsize of nf_conntrack. My INVALID packets vanished after this (at least as long as I wasn't using conntrackd for stateful failover).
best regards Bernhard -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
