Buffer problem... or DoS?

Barrett G. Lyon (blyon@netpr.com)
Mon, 15 Mar 1999 03:06:11 -0600


I run a rather loaded production AlphaLinux box. Today it started to have
some odd problems that I have not seen before. The first thing I noticed
was that it had a buffer problem:

telnet: Unable to connect to remote host: No buffer space available

Mar 14 12:32:03 xxx.xxx.xxx.xxx named[10205]: ns_forw:
sendto([206.253.194.65].53): No buffer space available

Linux arsenic 2.2.2 #3 Wed Feb 17 14:07:01 PST 1999 alpha unknow
12:15pm up 3 days, 23:47, 13 users, load average: 2.22, 1.53, 1.69
512mb ram / aic7xxx / tulip

slabinfo - version: 1.0
kmem_cache 28 42
pio_request 0 0
tcp_tw_bucket 12 63
tcp_bind_bucket 730 1143
tcp_open_request 25 84
skbuff_head_cache 245 864
sock 972 1395
dquot 256 300
filp 12778 12800
signal_queue 0 0
buffer_head 10532 16100
mm_struct 395 558
vm_area_struct 17178 19278
dentry_cache 71381 71388
files_cache 394 560
uid_cache 150 254
size-131072 0 0
size-65536 0 0
size-32768 0 0
size-16384 0 0
size-8192 4 6
size-4096 404 464
size-2048 179 304
size-1024 242 256
size-512 24 28
size-256 4395 4508
size-128 440 600
size-64 11471 11508
slab_cache 189 420

The second item I noticed was that there was some odd traffic hitting it.
xxx.xxx.xxx.xxx = AlphaLinux box
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667
99/03/14 12:44:48 !I 00 194.248.38.53 -> xxx.xxx.xxx.xxx UDP 1938 ->
6667

128192 of these packets hit the machine in about 4 minutes. During that
time the buffer problem started. The machine's IP stack stoped working and
from a network pov. the machine was gone.

After the traffic stoped, network operations on the box no longer oprated
the same.

Any ideas of what happened here?

-Barrett

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/