From owner-freebsd-net@FreeBSD.ORG Thu Feb 15 21:32:31 2007 Return-Path: X-Original-To: freebsd-net@freebsd.org Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id AD3A616A400 for ; Thu, 15 Feb 2007 21:32:30 +0000 (UTC) (envelope-from sam@errno.com) Received: from ebb.errno.com (ebb.errno.com [69.12.149.25]) by mx1.freebsd.org (Postfix) with ESMTP id 6988313C481 for ; Thu, 15 Feb 2007 21:32:30 +0000 (UTC) (envelope-from sam@errno.com) Received: from [10.0.0.248] (trouble.errno.com [10.0.0.248]) (authenticated bits=0) by ebb.errno.com (8.13.6/8.12.6) with ESMTP id l1FLWT5b013536 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Thu, 15 Feb 2007 13:32:30 -0800 (PST) (envelope-from sam@errno.com) Message-ID: <45D4D16D.2000205@errno.com> Date: Thu, 15 Feb 2007 13:32:29 -0800 From: Sam Leffler User-Agent: Thunderbird 1.5.0.9 (X11/20070208) MIME-Version: 1.0 To: John Polstra References: In-Reply-To: X-Enigmail-Version: 0.94.0.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Cc: freebsd-net@freebsd.org Subject: Re: bge0: discard frame w/o packet header X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Feb 2007 21:32:31 -0000 John Polstra wrote: > I have a Dell SC1435 server running an i386 -current system from > around the end of December, with a few selected updates applied. It > had been running reliably until early this morning, when the > following sequence of events happened. First, this message was > logged: > > Feb 15 07:14:29 rock kernel: bge0: discard frame w/o packet header > > About 2 minutes later, at 07:16:30, the last /var/log/maillog entry > was logged. (This machine is under constant assault from spambots > trying dictionary attacks. It is rare for more than 15 seconds to > pass without something being logged in the maillog file.) > > 30 seconds after that came another bge message: > > Feb 15 07:17:00 rock kernel: bge0: discard frame w/o packet header > > At that point, all network connectivity was gone. The machine didn't > respond to pings. Worse, its remote management controller, which uses > ASF and shares the same network interface, was also unresponsive to > pings. To get the machine back, I had to ask somebody working at the > colocation facility to power-cycle it. > > The "discard frame w/o packet header" message comes from ether_input() > if it gets an mbuf that doesn't have the M_PKTHDR flag set. That > can't happen unless something is very wrong with the system. I'd like > to make it a panic. At least then the machine would reboot instead of > just becoming unreachable. Any objections? > > Some other nearby warnings should also be panics, in my opinion: > > discard frame w/o leading ethernet header ... > > discard frame w/o interface pointer ... > > and, maybe: > > discard oversize frame ... > > Opinions? There are several diagnostics in ether_input I added mostly because drivers "shouldn't do that"; this is one of them. However some are questionable. I'm not sure about the panic but at the least we should rate limit the messages so they can't be used as a DOS mechanism. Replacing them with counters and sticking the printf's under IFF_DEBUG is another option. Sam