From owner-freebsd-security Thu Nov 2 14:37:17 2000 Delivered-To: freebsd-security@freebsd.org Received: from earth.wnm.net (earth.wnm.net [208.246.240.243]) by hub.freebsd.org (Postfix) with ESMTP id AFE6D37B4C5 for ; Thu, 2 Nov 2000 14:37:10 -0800 (PST) Received: from localhost (alex@localhost) by earth.wnm.net (8.11.0/8.11.0) with ESMTP id eA2MaUO08759; Thu, 2 Nov 2000 16:36:30 -0600 (CST) Date: Thu, 2 Nov 2000 16:36:30 -0600 (CST) From: Alex Charalabidis To: Buliwyf McGraw Cc: security@FreeBSD.ORG Subject: Re: DOS attack In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Thu, 2 Nov 2000, Buliwyf McGraw wrote: > > Ok... here we go again ;) > I was researching about the last incidents on the machine with the > system load problem (possible attack) ... > I get this: the service which crash the server when the problem > starts is the famous "squid". > Normal days, the squid is running without problems and the load of > the server is 0.5 (average), the required cputime for the program > is 20%. Then the world is beatiful. > But, when we have a bad day... the squid need 90% 95% 100% cputime > and the load of the server jump until crash. The interrupts are too > big in these moments. > If i quit the network cable from the server... the load dissapear and > everything is rigth, but, if i put the network cable again... booom!!! > > The problem isnt everyday, is just sometimes, somedays... few hours. > Make sure squid isn't eating up all your swap space. If you allocate it too much memory, it'll start thrashing badly. Haven't seen it crash from this but it sure makes everything slooow. -ac -- ============================================================== Alex Charalabidis (AC8139) 5050 Poplar Ave, Ste 170 System Administrator Memphis, TN 38157 WebNet Memphis (901) 432 6000 Author, The Book of IRC http://www.bookofirc.com/ ============================================================== To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message