From owner-freebsd-security  Thu Nov  2 15:18:30 2000
Delivered-To: freebsd-security@freebsd.org
Received: from libertad.univalle.edu.co (libertad.univalle.edu.co [216.6.69.11])
	by hub.freebsd.org (Postfix) with ESMTP id 48BDD37B479
	for <security@FreeBSD.ORG>; Thu,  2 Nov 2000 15:18:13 -0800 (PST)
Received: from localhost (buliwyf@localhost)
	by libertad.univalle.edu.co (8.10.0/8.10.0) with ESMTP id eA2NQqC22483
	for <security@FreeBSD.ORG>; Thu, 2 Nov 2000 18:26:54 -0500 (COT)
Date: Thu, 2 Nov 2000 18:26:52 -0500 (COT)
From: Buliwyf McGraw <buliwyf@libertad.univalle.edu.co>
To: security@FreeBSD.ORG
Subject: Re: DOS attack II
In-Reply-To: <Pine.BSF.4.21.0011021424150.26450-100000@localhost>
Message-ID: <Pine.BSF.4.21.0011021753550.20146-100000@libertad.univalle.edu.co>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


> Have you checked your squid logs for the times when server load goes too
> high?

  It was the first thing we did... but there is not something different 
  or strange in the logs... i check the /var/log/messages and the squid
  logs... the only special thing was what i told you:
                "icmp_request bandwidth limit 105/100 pps" 
  Nothing more.
  
> Just a wild guess, but you may have an open HTTP proxy, being abused by
> people who get paid for each click on a banner. 
 
  The proxy isn't open. It is only for my domain... the problem maybe is
  that we have much users... but anyway, the proxy was working good until
  some weeks ago. 

> What is the source of the squid connections? 

  All my intranet (only) do the requests. Internet give us the answers.

  The next time, when the problems come back, i gonna use tcpdump to check
  what is coming to the interface... i will use ttt to see what is the
  protocol with more load in the segment... and then i expect get
  something about the problem.

  Thanks for Any coment...
 



> On Thu, 2 Nov 2000, Buliwyf McGraw wrote:
> 
> > 
> >  I was researching about the last incidents on the machine with the
> >  system load problem (possible attack) ... 
> >  I get this: the service which crash the server when the problem 
> >  starts is the famous "squid".
> >  Normal days, the squid is running without problems and the load of 
> >  the server is 0.5 (average), the required cputime for the program
> >  is 20%. Then the world is beatiful.
> >  But, when we have a bad day... the squid need 90% 95% 100% cputime
> >  and the load of the server jump until crash. The interrupts are too
> >  big in these moments.
> >  If i quit the network cable from the server... the load dissapear and
> >  everything is rigth, but, if i put the network cable again... booom!!!
> > 
> >  The problem isnt everyday, is just sometimes, somedays... few hours.
> > 
> >  Thanks for any comment or sugestion... ;)
> 

=======================================================================
 Buliwyf McGraw
 Administrador del Servidor Libertad
 Centro de Servicios de Informacion
 Universidad del Valle
=======================================================================




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message