Too many connections on the same IP

[John Wobus]

Re firewalls: I've been forced to adjust firewall rules
to be stateless to get busy DNS servers to work.
If the state table is filling, that's easy to check.
Stateless rules have traps for the unwary so assure
yourself that you understand all the issues.
Specifically, make sure return traffic isn't triggering
state.

Over the years as typical memory in a server grows,
systems' default tuning parameters have increased
and often things do just work without such adjustments.

Another tuning issue for bind is assuring it is configured
to handle sufficient recursive queries for your load.
This is also easy to check so should be one of the
first things checked.

Given that you say only one of your servers' IP
addresses has the issue, all this seems
moot.  Viewing the connections with netstat seems
useful.  Or if there is another system on
the same IP, it is crucial to fix that.  Such a
problem could just kill communications but it could
also cause symptoms that only show under load.

Another thought is a firewall in front of your server.
And speaking of firewalls, some have a feature to
govern the level of load they allow into of a part.

John Wobus
Cornell University IT