full socket buffers

[Chris Marget]

On Fri, Feb 11, 2011 at 5:40 AM, Mirek Lauš <mirek at admino.cz> wrote:
> On Wed, Feb 9, 2011 at 6:25 PM, Friesen, Don SSBC:EX
> <Don.Friesen at gov.bc.ca> wrote:
>>>>
>>>> No. It is completely random. When the issue occur, the netstat -s -p
>>>> udp show continual
>>>> loss of UDP packets due to full socket buffers.
>>>>
>>>> I already stated that the kern.ipc.maxsockbuf is set to 8MB and
>>>> net.inet.udp.recvspace is set to 1MB. How can I monitor buffer usage?
>>>
>>>And no, there is no heavy network traffic at the time.
>>>
>>
>>  What is the buffer full of?  What sort of packets are coming off?  Can you capture a snoop and analyze the ports
>
> How do I find what is the buffer full of? There is only DHCP and LDAP
> syncrepl traffic on the server.

These are per-socket buffers.  They'll be full of whatever UDP
datagrams were addressed to the port in question.  (you're losing
incoming datagrams, right?)