Re: [security] Big problem on 2.0.x? (fwd)

Gerhard Mack (gmack@merlin.severious.net)
Fri, 17 Dec 1999 07:39:20 +0000 ( )

On Thu, 16 Dec 1999, Dan Yocum wrote:

>
> > The SYN flood message said:
> >
> > 131.225.55.9 on 131.225.55.98:635
> >
> > The NFS server is 131.225.55.98. So it's very very unlikely that the NFS
>
> Sorry, I should have clarified. Those were 2 separate problems on 4 separate
> boxes.
>
> > NOTE: the 131.225.55.9 is not reliable. The attack could came from
> > everywhere in the world. You can trace it only by tracing the routing by
> > hand.
>
> I was actually on the client machine trying to mount the dir on the server and
> watching the server log fill up with the SYN flood messages, so I can verify
> that no spoofing was occuring - it was all me.
>
> >
> > >messages. Maybe there's a relation there that's causing the mountd to
> > >die as well. I'm not intimately acquainted with the details - I just
> > >see the results.
> >
> > Ok I understand.
> >
> > IMHO the source of these problems is outside the kernel.
>
> I'd believe that. Likely, these problems will go away when we make our next
> distribution release and everyone at the Lab upgrades to the 2.2.x kernel - we
> still have over a year before the Tevatron goes into collider mode and we have
> real data streaming in. Heck, maybe we'll have 3.0.x by then.

Ive seen these warnings triggered by lossy connections or buggy irc
clients, in 2.0.x is just too easy set off those warnings. 2.2.x under
the same conditions seems to hold up better.

Gerhard


--
Gerhard Mack


gmack@merlin.severious.net


<>< As a computer I find your faith in technology amusing.




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/