Messages in this thread | | | Date | Wed, 22 Jul 1998 19:01:11 +0200 | From | Chris Black <> | Subject | Re: SYN trouble, hardware or software? |
| |
Geert Uytterhoeven wrote: > > On Wed, 22 Jul 1998, Chris Black wrote: > > handshake (I think). We get messages on the master suck as: > > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from > > 192.168.1.12 on 192.168.1.1:20817. Sending cookies. > > Jul 21 20:53:13 isrec-insect kernel: Warning: possible SYN flood from > > 192.168.1.7 on 192.168.1.1:20860. Sending cookies. [...] > > (er, that "suck" should be "such", but "suck" also applies) > > > > And on the slaves we get similar messages: > > Jul 19 22:49:26 insect-01 kernel: Warning: possible SYN flood from > > 127.0.0.1 on 127.0.0.1:9027. Sending cookies. > > Jul 19 23:11:32 insect-01 kernel: Warning: possible SYN flood from > > 127.0.0.1 on 127.0.0.1:9027. Sending cookies. > > Jul 20 15:23:54 insect-01 kernel: Warning: possible SYN flood from > > 192.168.1.1 on 192.168.1.2:9027. Sending cookies. > > [...] > > Software: > > redhat linux 4.2, kernel 2.0.35 with "Jumbo-4" cyrix/cpuid patch. > > I've seen this on a 2.0.34 box (i486SX, 2x NE2000, 1x 3c509, routing, > masquerading). People complained that FTP to the box no longer worked, and > there were SYN flooding warnings in the logs. > > Then I tried to FTP from a box that was guaranteed not doing a SYN attack, and > that box appeared in the kernel log as a possible attacker too. Rebooting the > server fixed the problem. So I think this is a bug in the networking code. > > Greetings, > > Geert
Well, we know the internel nodes aren't doing syn attacks... Subsequent connections to the master from the nodes do work, so it doesn't prevent service longterm. We've rebooted a few times (for running dos hw diags and such, the hw diags come with these network cards suck), and that does not stop the problem. Also of note is that we used to get errors when running scripts with extensive rsh commands (bad mojo) that used to actually hang the server. This was with kernel 2.0.30 but after I upgraded rsh this stopped happening. The frozen machine was stuck in the routine: skb_recv_datagram() which is defined in net/core/datagram.c and used extensively in the net/ipv4/ tree. But this no longer happens since I upgraded rsh and friends (and then subsequently the kernel). But we also no longer use scripts with extensive rsh commands.
PS to list: sorry for the horrible formatting of the first message, I cut and pasted into the netscape mail program (I usually use exmh).
Chris
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |