conntrack performance test results in INVALID packets

[Bernhard Bock <mailinglists@xxxxxxx>]

Hi,

I'm performance testing a firewall with netfilter connection tracking 
based on Fedora Core 9 and I'm having some problems.

Every now and then the firewall drops packets in the state "INVALID".

The test setup is as follows:
- I'm using plain HTTP as test traffic, nothing else.
- Client is an ApacheBench (ab) client.
- Server is Apache.
- HTTP connection keepalive with a maximum lifetime of
  30 seconds per TCP session.

With 100 parallel TCP connections, it works. With 1000 parallel TCP 
connections, I start seeing INVALID packets.

Can somebody point me in a direction where to search for the root cause?

best regards
Bernhard

--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html