lkml.org 
[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SYN trouble, hardware or software?
Geert Uytterhoeven wrote:
>
> On Wed, 22 Jul 1998, Chris Black wrote:
> > handshake (I think). We get messages on the master suck as:
> > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.12 on 192.168.1.1:20817. Sending cookies.
> > Jul 21 20:53:13 isrec-insect kernel: Warning: possible SYN flood from
> > 192.168.1.7 on 192.168.1.1:20860. Sending cookies.
[...]
> > (er, that "suck" should be "such", but "suck" also applies)
> >
> > And on the slaves we get similar messages:
> > Jul 19 22:49:26 insect-01 kernel: Warning: possible SYN flood from
> > 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> > Jul 19 23:11:32 insect-01 kernel: Warning: possible SYN flood from
> > 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> > Jul 20 15:23:54 insect-01 kernel: Warning: possible SYN flood from
> > 192.168.1.1 on 192.168.1.2:9027. Sending cookies.
> >
[...]
> > Software:
> > redhat linux 4.2, kernel 2.0.35 with "Jumbo-4" cyrix/cpuid patch.
>
> I've seen this on a 2.0.34 box (i486SX, 2x NE2000, 1x 3c509, routing,
> masquerading). People complained that FTP to the box no longer worked, and
> there were SYN flooding warnings in the logs.
>
> Then I tried to FTP from a box that was guaranteed not doing a SYN attack, and
> that box appeared in the kernel log as a possible attacker too. Rebooting the
> server fixed the problem. So I think this is a bug in the networking code.
>
> Greetings,
>
> Geert

Well, we know the internel nodes aren't doing syn attacks...
Subsequent connections to the master from the nodes do work, so it
doesn't
prevent service longterm.
We've rebooted a few times (for running dos hw diags and such, the hw
diags
come with these network cards suck), and that does not stop the problem.
Also of note is that we used to get errors when running scripts with
extensive
rsh commands (bad mojo) that used to actually hang the server. This was
with
kernel 2.0.30 but after I upgraded rsh this stopped happening. The
frozen machine
was stuck in the routine: skb_recv_datagram() which is defined in
net/core/datagram.c and used extensively in the net/ipv4/ tree.
But this no longer happens since I upgraded rsh and friends (and then
subsequently the kernel). But we also no longer use scripts with
extensive
rsh commands.

PS to list: sorry for the horrible formatting of the first message, I
cut and
pasted into the netscape mail program (I usually use exmh).

Chris

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.062 / U:0.152 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site