From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 525D8138330 for ; Mon, 19 Sep 2016 17:23:46 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id EB666E0B2B; Mon, 19 Sep 2016 17:23:37 +0000 (UTC) Received: from mail-qk0-f176.google.com (mail-qk0-f176.google.com [209.85.220.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 30857E0B0D for ; Mon, 19 Sep 2016 17:23:35 +0000 (UTC) Received: by mail-qk0-f176.google.com with SMTP id n185so17013455qke.1 for ; Mon, 19 Sep 2016 10:23:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to; bh=yx+kzKLCuRzq9P2wtS+2IYDD+SXqirf9ceu5YUbRb3c=; b=L9Kj5tLk5olbVx89VERqWnU6ABuXUlyuSyDYa6gyj1bc8NgIHvcNAjdvy4sxkRMRwZ 87s7+Aj4z9+rWVhMMUfZOAPZRLDh0lsu5reKQstNmUNLdTuypaNOJg+geQ0wS+5lmrQR luwMtgc3GC/t2muXfpypAVt9cY9NRYETKY8uuOk5CxFU//fg+GCTRKB6aChCYW9BfykU RT/L18ysR6Zt46PUesq+r0n/G1+m0sjMi80UfyURCFDEtCaLIxV02tyx5FFxN1STpnP4 IkOu9xl/gGa8UrQIxT1aTCstev8mwWdHvwMa2tTGkC7SgZFj47ANtINyn8k4a98EcLtN 96sA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to; bh=yx+kzKLCuRzq9P2wtS+2IYDD+SXqirf9ceu5YUbRb3c=; b=abSwUoNdHMY7dmfoYeisQmIWH/UgYwLiY9Yqd0WNovva5w16NM0uvVNoDdbYVzawEv 9gBJ2gDDDMod+P0wr48Lc6jGbLAWOQz2SwdsCryqOE/qTBwDG16cXv3srHWe4din2f81 zVM/zKgUm3qykl9PXFSXjSWjEWm+D5u9jpa1mRLg75VkiVhTLcjoTR5q67dpDQsa7te6 kN4mV3RGhTfD2NnK/c/1oD1cE1wTCcXX5Fgupla2LPfcVkj7MzeGwuCPeIBlggYwBMP3 s9eWFBxnHXrEe4YgCZ0I3/8dL+JSVRRrUjT0iig47KgaiMVR6EqZ/aX7Rh8robKpk/Hm ITzw== X-Gm-Message-State: AE9vXwNfbqpym4R+Tbx8kLGMyNezWLXoam52ILXQDnKgcleYoqhrXowesWQeIJqKTaz1SMcA8ng77tkUXhrMMA== X-Received: by 10.55.204.82 with SMTP id r79mr32641376qki.240.1474305814284; Mon, 19 Sep 2016 10:23:34 -0700 (PDT) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-user@lists.gentoo.org Reply-to: gentoo-user@lists.gentoo.org MIME-Version: 1.0 Received: by 10.140.38.179 with HTTP; Mon, 19 Sep 2016 10:23:33 -0700 (PDT) In-Reply-To: References: From: Grant Date: Mon, 19 Sep 2016 10:23:33 -0700 Message-ID: Subject: [gentoo-user] Re: TCP Queuing problem To: Gentoo mailing list Content-Type: text/plain; charset=UTF-8 X-Archives-Salt: 2e92eba8-7066-41ff-b983-45bdaf17e4ef X-Archives-Hash: 2ab8773552259e518be8eca9bba48c61 > My web server's response time for http requests skyrockets every > weekday between about 9am and 5pm. I've gone over my munin graphs and > the only one that really correlates well with the slowdown is "TCP > Queuing". It looks like I normally have about 400 packets per second > graphed as "direct copy from queue" in munin throughout the day, but 2 > to 3.5 times that many are periodically graphed during work hours. I > don't see the same pattern at all from the graph of all traffic on my > network interface which actually peaks over the weekend. TCP Queuing > doesn't rise above 400 packets per second all weekend. This is > consistent week after week. > > My two employees come into work during the hours in question, and they > certainly make frequent requests of the web server while at work, but > if their volume of requests were the cause of the problem then that > would be reflected in the graph of web server requests but it is not. > I do run a small MTU on the systems at work due to the config of the > modem/router we have there. > > Is this a recognizable problem to anyone? I'm in the midst of this. Are there certain attacks I should check for? - Grant