From owner-freebsd-isp Wed Mar 28 18:25: 0 2001 Delivered-To: freebsd-isp@freebsd.org Received: from www.golsyd.net.au (golsyd.net.au [203.57.20.1]) by hub.freebsd.org (Postfix) with ESMTP id 5673F37B724 for ; Wed, 28 Mar 2001 18:24:57 -0800 (PST) (envelope-from kaltorak@quake.com.au) Received: from [203.164.12.28] by www.quake.com.au (NTMail 4.30.0012/AB6169.63.5724aadf) with ESMTP id ilsaaaaa for ; Thu, 29 Mar 2001 12:24:40 +1000 Message-ID: <3AC29DB4.7EBD2143@quake.com.au> Date: Thu, 29 Mar 2001 12:28:04 +1000 From: Kal Torak X-Mailer: Mozilla 4.73 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Tom ONeil Cc: Free Subject: Re: DOS Attack? "No memory for tx list, out of mbufs" References: <3AC201D1.5B167E0F@tacni.net> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-freebsd-isp@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Tom ONeil wrote: > > Greetings All and thanks for the help over the years, > > Got this in the logs, machine was locked up and had to reboot. > > Mar 27 23:13:45 pendragon proftpd[58667]: pendragon.tacni.net > (XXX.XXX.XXX.XXX[XXX.XXX.XXX.XXX]) - FTP session closed. > Mar 28 07:08:05 pendragon /kernel: rl0: no memory for tx list > Mar 28 07:08:05 pendragon /kernel: rl0: out of mbufs, tried to copy 86 > bytes Have you got the latest version of proftpd? There is a DoS attack for it atm, in phrasing things like: ls */../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../*/../* Infact I dont think there is a patch to fix this yet... You should check the proftpd site... A few things to stop the attack would be to start proftpd with some ulimits so it cant take all the system resources, also in your config put something like DenyFilter \*.*/ Hope that helps! To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-isp" in the body of the message