PF State Table Exhaustion Under Traffic Spikes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

New connections fail while existing sessions continue, especially during bursts.

Environment & Reproduction

State limit too low, abusive traffic patterns, or missing timeout tuning.

Root Cause Analysis

Use pfctl -si and pfctl -ss | wc -l to compare current and max states.

Quick Triage

Raise state limits cautiously and block obvious abusive sources.

Step-by-Step Diagnosis

Run pfctl -si and watch state growth while replaying traffic patterns.

Solution – Primary Fix

Inspect /etc/pf.conf for set limit states and aggressive timeout directives.

Solution – Alternative Approaches

Tune state limits, optimize rules to reduce unnecessary states, and apply rate controls.

Verification & Acceptance Criteria

Confirm new connections establish successfully during synthetic and real traffic peaks.

Rollback Plan

Baseline normal state usage and alert when thresholds approach saturation.

Prevention & Hardening

Reapply previous limits if latency or memory pressure worsens after tuning.

Related Errors & Cross-Refs

Escalate for DDoS-scale events requiring upstream filtering or scrubbing services.

Related tutorial: View the step-by-step tutorial for freebsd-15.

View all freebsd-15 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

pfctl -si; pfctl -ss; pfctl -f /etc/pf.conf; tcpdump -n -e -ttt -i pflog0