[lkml]   [2003]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: preventing route cache overflow
On Thu, 2003-02-27 at 12:50, Patrick Michael Kane wrote:
> We recently had a server come under attack. Some script monkeys
> started generating a bunch of pings and SYNs from a huge variety of
> spoofed addresses (mostly in and, for those that
> are interested).
> There were so many forged packets that the destination cache began to
> overflow hundreds or thousands of times per second ("kernel: dst cache
> overflow"). This had a huge negative impact on server performance.

Was this just syslog doing lots of write()+fsync() ? What kernel

You should not get those messages that often in your logs, they should
be ratelimited:

if (net_ratelimit())
printk(KERN_WARNING "dst cache overflow\n");

// Gianni Tedesco (gianni at scaramanga dot co dot uk)
lynx --source | gpg --import
8646BE7D: 6D9F 2287 870E A2C9 8F60 3A3C 91B5 7669 8646 BE7D
[unhandled content-type:application/pgp-signature]
 \ /
  Last update: 2005-03-22 13:33    [W:0.038 / U:6.492 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site