From owner-freebsd-security  Fri Feb  7 21:13:24 1997
Return-Path: <owner-security>
Received: (from root@localhost)
          by freefall.freebsd.org (8.8.5/8.8.5) id VAA24420
          for security-outgoing; Fri, 7 Feb 1997 21:13:24 -0800 (PST)
Received: from excel.tnet.com.au (excel.tnet.com.au [203.15.94.3])
          by freefall.freebsd.org (8.8.5/8.8.5) with ESMTP id VAA24380;
          Fri, 7 Feb 1997 21:13:06 -0800 (PST)
Received: (from slaterm@localhost) by excel.tnet.com.au (8.7.4/8.7.3) id NAA01187; Sat, 8 Feb 1997 13:18:00 +0800
Date: Sat, 8 Feb 1997 13:18:00 +0800 (WST)
From: Michael Slater <slaterm@excel.tnet.com.au>
To: Chris Walth <walth@scanners.tec.mn.us>
cc: questions@freebsd.org, isp@freebsd.org, security@freebsd.org
Subject: Re: Problems? or denial of service attack?
In-Reply-To: <Pine.BSF.3.91.970207221333.1664A-100000@scanners.tec.mn.us>
Message-ID: <Pine.LNX.3.91.970208131704.425A-100000@excel.tnet.com.au>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk



>   I am running a server currently with FreeBSD 2.1.0-RELEASE.  Yes I know 
> that it is outdated ;)
> 
>   What I have is someone connecting to port 25 and sending a lot of email 
> messages from a dialup port.  I am currently tracing the dialup port.
> 
>   In the process of looking into this problem I noticed many pages of log 
> entries that state the vm_???  has killed a process and also some about 
> out of swap space.
> 
>   Here are a couple of the messages:
> 
> Feb  7 00:07:51 scanners /kernel: Process 26028 killed by vm_fault -- 
> out of swap
> Feb  7 00:07:51 scanners /kernel: swap_pager: out of space
> Feb  7 00:07:52 scanners /kernel: Process 25867 killed by vm_pageout -- 
> out of swap
> Feb  7 00:07:52 scanners /kernel: swap_pager: out of space

It looks like you are out of Swap space...

Michael Slater
slaterm@tnet.com.au