Subject: Http-gw slowness

From: "Reid Hayhow" <[email-masked]>
Date: Thu, 17 Aug 2000 11:26:35 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi,

    I have inherited a Firewall using FWTK and recently it has started to
have some problems, mainly slooooow web and email response times. First,
here is configuration information, I am using a Linux box, 486, 16 meg RAM,
2 ethernet cards. The kernel is 2.2. From the log files it appears that it
is using v2.0 beta executables.
    The problems:

        1) At first we experienced intermittent slowdowns through http-gw
(once a month), but for the last three weeks the slowdown has persisted.
Pages can take minutes to load instead of 2-5 seconds. The log files show a
bunch of "Host address lookup failed" warnings. From reading the FWTK
archives I saw that this might be a DNS problem. But I also have downloaded
'tinyproxy' (a simple web proxy) and connections through it are very fast. I
am hoping this rules out DNS problems. Another thing that seems kind of
quirky, the slowdown seems to happen during the connect. Once the page
starts to load it goes fairly quickly (graphics experience a similar initial
delay and quick eventual load).

        2) Email connections are slow through plug-gw. I have set my timeout
to 3 minutes because it appears to take about 2.5 minutes to simply connect
to our email server. As above, once the connect happens the authentication
and email download is fast. It just takes 2+ minutes to find and connect to
the email server on the other side of the firewall.

I have downloaded the latest source and done a build. I set up the new
http-gw on a different port and ran it with the same slowness. So I don't
think it is an executable specific problem.

    Any thoughts or suggestions would be appreciated.

Reid

---

From: Mark C Farone <[email-masked]>
Date: Thu, 17 Aug 2000 15:48:32 -0400

>is using v2.0 beta executables.

You might be having the classic SYN-ACK problem if you are using a 
kernel earlier than 2.2.11.   I've at least seen it cause problems 
with smap.

You'll want to consider running 2.2.12 or higher to avoid those bugs 
and security holes (take a look at 
http://www.kernelnotes.org/kpatch22.html and the fixes for tcp).  The 
problem was (essentially) that the linux box doesn't understand the 
ack properly and never responds.

tcpdump might be helpful to identify if this is your problem.

Also, if your generating oodles of logged errors, with that small 
amount of RAM you might want to run 'free' and see if you're paging 
memory to the disk and that disk is close to full.

Hope this helps,
Mark

-- 
Mark C. Farone <[email-masked]>   In the future,
Systems Analyst, Gainesville Sun        everything will work.

---

From: Rick Murphy <[email-masked]>
Date: Thu, 17 Aug 2000 18:39:52 -0400

>is using v2.0 beta executables.

The easiest way to eliminate DNS problems is to try it on the firewall.
nslookup a.b.com        where 'a.b.com' is the site you're trying to get to.
nslookup 1.2.3.4        Where '1.2.3.4' is the IP address of that site
nslookup 5.6.7.8        where '5.6.7.8' is the IP address of your client 
machine

If any of these are slow, you've got a DNS problem. Reverse lookups for the 
internal network are a frequently seen misconfiguration that can lead to 
very slow response times.
         -Rick

---

From: "Nico Baggus" <[email-masked]>
Date: Fri, 18 Aug 2000 00:58:53 +0200

> and security holes (take a look at 

You probably want kernel V 2.2.16
It fixes a huge hole where someone can disable
the SUID capability, causing a suid program to
not change identity. i.e. it will stay root.....

regards,
Nico Baggus