From owner-freebsd-security Thu Nov 2 12: 7:33 2000 Delivered-To: freebsd-security@freebsd.org Received: from libertad.univalle.edu.co (libertad.univalle.edu.co [216.6.69.11]) by hub.freebsd.org (Postfix) with ESMTP id 4149A37B4CF for ; Thu, 2 Nov 2000 12:06:42 -0800 (PST) Received: from localhost (buliwyf@localhost) by libertad.univalle.edu.co (8.10.0/8.10.0) with ESMTP id eA2KFNw12845 for ; Thu, 2 Nov 2000 15:15:24 -0500 (COT) Date: Thu, 2 Nov 2000 15:15:23 -0500 (COT) From: Buliwyf McGraw To: security@FreeBSD.ORG Subject: DOS attack Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Ok... here we go again ;) I was researching about the last incidents on the machine with the system load problem (possible attack) ... I get this: the service which crash the server when the problem starts is the famous "squid". Normal days, the squid is running without problems and the load of the server is 0.5 (average), the required cputime for the program is 20%. Then the world is beatiful. But, when we have a bad day... the squid need 90% 95% 100% cputime and the load of the server jump until crash. The interrupts are too big in these moments. If i quit the network cable from the server... the load dissapear and everything is rigth, but, if i put the network cable again... booom!!! The problem isnt everyday, is just sometimes, somedays... few hours. Thanks for any comment or sugestion... ;) ======================================================================= Buliwyf McGraw Administrador del Servidor Libertad Centro de Servicios de Informacion Universidad del Valle ======================================================================= To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message