dropped by fwconn_memory_check

[jabberw0cky]

I am seeing this error message:

fw_log_drop: Packet proto=6 x.x.x.x:44559 -> x.x.x.x:80 dropped by fwconn_memory_check Reason: no memory available

Is this caused be reaching the maximum number of connections in the connections table?

Could this cause high CPU utilization?

Will increasing the size of the connection table alleviate the problem?

[melipla]

I would think that it's more of a problem of not having enough memory for the number of connections you currently allow. From what I understand X amount of memory is allocated per connection and if there is no memory left to allocate you'll see this error.

What OS and FW version? How much memory do you have installed? How much memory is being used? A "fw ctl pstat" output may be beneficial to see.

The following SK seems a bit dated, but may help:
------------------------------------------------
How to solve the error "Not enough memory"

Solution ID: #sk18289

Product: SecurePlatform
Version: NG
Last Modified: 26-Feb-2004
Symptoms

* The following error message is displayed after the configured number of maximum concurrent connections is set to a higher value than the default: "Not enough memory"
* 1GB RAM or more
* A lot of free RAM exists Can be identified by running the command: fw ctl pstat and looking for smem

Cause
The FireWall-1 kernel may be unable to allocate enough memory and policy installation may fail with error

Solution
For NG FP3, as a workaround, the machine can be configured to boot with 512MB RAM.
The issue is solved in FP3 HF2 HFA 324 and FireWall-1 NG with Application Intelligence, but is 'off' by default because of risk management considerations.
To get large amounts of memory on Linux machines with 1GB memory or more, do the following actions:
Create a file named fwkern.conf in $FWDIR/boot/modules/ (it may already exist - if so, keep the current contents and just add the new lines below).
Add the following two lines to the file:
fw_smem_use_alternate_malloc=1
fw_hmem_use_alternate_malloc=1
Then reboot the machine.
Applies To:

* SecurePlatform NG FP3
* Linux
* FireWall-1 NG with Application Intelligence
* VPN-1 NG with Application Intelligence
* FireWall-1 NG FP3
* VPN-1 NG FP3
* Policy installation
* Memory
* RAM
* Maximum concurrent connections
---------------------------------------------
There's a couple KB articles about FWs with more then 512M of RAM. If you're using SPLAT I'd recommend looking at those too.

[jabberw0cky]

The platform is a Crossbeam C30. OS is linux. The fw version is AI R55. Here is the fw ctl pstat:

System kernel memory (smem) statistics:
Total memory bytes used: 146,574,272 peak: 147971504
Blocking memory bytes used: 71566732 peak: 71946172
Non-Blocking memory bytes used: 75007540 peak: 76025332
Allocations: 3728204 alloc, 2 failed alloc, 3614718 free, 0 failed free


The box has 4 gig of memory