Hi,
we have several opnsense-setups with Maltrail in Sensor-Only-Mode. We then use a "central" opnsense as Maltrail-Server. From time to time we see following error on console:
sonewconn: pcb 0xfffff804244869b0 (0.0.0.0:8338 (proto 6)): Listen queue overflow: 8 already in queue awaiting acceptance (2 occurrences)
Changing the tunable for sonewconn does not help. I guess we have to much sending "sensors" for the server, but how to allow the server to accept more connections in opnsense?
Should it be enough to set tunable
kern.ipc.somaxconn and kern.ipc.soacceptqueue ?