From owner-freebsd-questions Sun Aug 19 15:34:27 2001 Delivered-To: freebsd-questions@freebsd.org Received: from digitaldaemon.com (digitaldaemon.com [63.105.9.34]) by hub.freebsd.org (Postfix) with SMTP id 0AD9637B40F for ; Sun, 19 Aug 2001 15:34:22 -0700 (PDT) (envelope-from jan@digitaldaemon.com) Received: (qmail 86255 invoked from network); 19 Aug 2001 22:32:05 -0000 Received: from unknown (HELO digitaldaemon.com) (192.168.0.73) by digitaldaemon.com with SMTP; 19 Aug 2001 22:32:05 -0000 Message-ID: <3B803E5E.8090204@digitaldaemon.com> Date: Sun, 19 Aug 2001 18:31:58 -0400 From: Jan Knepper User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1 X-Accept-Language: en-us MIME-Version: 1.0 To: FreeBSD Questions Subject: [Fwd: Re: slashdotted: /kernel: xl0: no memory for rx list -- packet dropped!] Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Hi! Does anyone here know what to do about this? Thanks! Jan -------- Original Message -------- From: - Sat Aug 18 12:19:58 2001 X-UIDL: 998151141.23696.digitaldaemon.com,S=3760 X-Mozilla-Status: 0013 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: jan@digitaldaemon.com Received: (qmail 23693 invoked from network); 18 Aug 2001 16:12:20 -0000 Received: from unknown (HELO sm4.texas.rr.com) ( root@24.93.35.211 ) by digitaldaemon.com with SMTP; 18 Aug 2001 16:12:20 -0000 Received: from [192.168.0.138] (cs6668179-144.austin.rr.com [66.68.179.144]) by sm4.texas.rr.com (8.12.0.Beta5/8.12.0.Beta5) with ESMTP id f7IGE8KE018133; Sat, 18 Aug 2001 11:14:08 -0500 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Sat, 18 Aug 2001 11:14:12 -0500 Subject: Re: slashdotted: /kernel: xl0: no memory for rx list -- packet dropped! From: "Michael C. Wu" To: Jan Knepper , FreeBSD ISP Message-ID: In-Reply-To: <3B7E9205.7010604@digitaldaemon.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit on 08/18/2001 11:04 AM, Jan Knepper at jan@digitaldaemon.com wrote: > Last Thursday one of the sites I host got slashdotted > (http://www.slashdot.com/) and amazingly FreeBSD 4.3 on PIII 600 Mhz > with 128 MB RAM took the load gracefully. I.e. until around 5 PM EST > when I got messages like: This should a good enough system. > /kernel: xl0: no memory for rx list -- packet dropped! > > at the console... > > So what I did is, I terminated some of the daemon's that were not really > used as a couple of httpd server, etc. This seemed to solve the problem, > however... When I run a netstat -na right now I get the impression that > there is still some garbadge in memory from this experience: > > As: > tcp4 0 15360 63.105.9.61.20 217.80.179.220.2822 LAST_ACK > t cp4 0 15360 63.105.9.61.20 193.219.43.81.2591 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.2535 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.1736 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.1735 LAST_ACK > tcp4 0 15360 63.105.9.61.20 202.133.131.44.3651 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.4486 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.4338 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.3452 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.3449 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1825 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2922 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2390 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2310 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1598 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1597 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1556 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1553 LAST_ACK > tcp4 0 15360 63.105.9.61.20 203.195.181.4.1440 LAST_ACK > > I am sure this has been in there the last at least 24 hours and I can > see nothing is happening. I suspect that this is because of the no > memory for rx list, but I am not quite sure. I was kinda a cool feeling > though that FreeBSD didn't give up, but still runs!!! I think you might have been attacked by a well-known attack, simply named the LAST_ACK attack. It puts our TCP state machine into whack by not sending the proper TCP states. There is no way around it. > Is there anyway to clean thi s up without having to reboot the system? I don't know. :) -- keichiii@iteration.net To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message