Date: Thu, 29 Jun 2000 11:37:34 +0800 From: "Maksimov Maksim" <maksim@tts.tomsk.su> To: <freebsd-security@FreeBSD.ORG> Subject: Re: How defend from stream2.c attack? Message-ID: <000301bfe17b$5d9954a0$0c3214d4@dragonland.tts.tomsk.su>
next in thread | raw e-mail | index | archive | help
Problem solved!!! I take PCI network card - 3Com 3c905B-TX Fast Etherlink XL (aka xl0) and now stream(2).c attack not freezed my FreeBSD 4.0 Stable. And though interrupr reached 40-45% I can work at console and network services is available! Thanks! > > Well, I cvsup'd here, and I can't reproduce the problem. > > I'd guess that when the interrupts hit 100%, something's going really > wrong, and the system is crashing. I'm really not sure what > can be done > about that, since the problem's that the processor just can't > offload data > from the NIC fast enough. > > IF you want to test to make sure that's the problem, perhaps try some > other type of flood, and see if you can reproduce the > problem; my guess is > that you'll see the same problem. > > I'm not sure if there is a fix, in this case. Other than > upgrading the > processor or NIC (if it's an ISA NIC, I'd wager that a PCI > 10/100 would be > more efficient, given that it was designed for faster > operation), I think > you're just going to have to hope that an attacker can't > flood fast enough > to cause the problem. > > Actually, if they are ISA, you may want to try the following > two kernel > options: > > > # > # Options for `isa': > # > # AUTO_EOI_1 enables the `automatic EOI' feature for the master 8259A > # interrupt controller. This saves about 0.7-1.25 usec for each > interrupt. > # This option breaks suspend/resume on some portables. > # > # AUTO_EOI_2 enables the `automatic EOI' feature for the slave 8259A > # interrupt controller. This saves about 0.7-1.25 usec for each > interrupt. > # Automatic EOI is documented not to work for for the slave with the > # original i8259A, but it works for some clones and some integrated > # versions. > > Perhaps they might help. > > Mike "Silby" Silbersack > > On Fri, 23 Jun 2000, Maksimov Maksim wrote: > > > > Hm. I noticed on my P100 that according to top, the > > > processor utilization due to interrupts was getting to > 40% or so during a > > stream2 > > > attack - what does top say for you? > > > > interrupts was getting to 98% > > > > > > > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?000301bfe17b$5d9954a0$0c3214d4>