From owner-freebsd-current Thu Jul 9 11:16:19 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id LAA25569 for freebsd-current-outgoing; Thu, 9 Jul 1998 11:16:19 -0700 (PDT) (envelope-from owner-freebsd-current@FreeBSD.ORG) Received: from whistle.com (s205m131.whistle.com [207.76.205.131]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id LAA25564 for ; Thu, 9 Jul 1998 11:16:18 -0700 (PDT) (envelope-from archie@whistle.com) Received: (from smap@localhost) by whistle.com (8.7.5/8.6.12) id LAA14947; Thu, 9 Jul 1998 11:15:47 -0700 (PDT) Received: from bubba.whistle.com(207.76.205.7) by whistle.com via smap (V1.3) id sma014942; Thu Jul 9 11:15:28 1998 Received: (from archie@localhost) by bubba.whistle.com (8.8.7/8.6.12) id LAA09514; Thu, 9 Jul 1998 11:15:28 -0700 (PDT) From: Archie Cobbs Message-Id: <199807091815.LAA09514@bubba.whistle.com> Subject: Re: Rate limit for system calls to prevent denial of service attacks? In-Reply-To: from Garance A Drosihn at "Jul 8, 98 07:38:54 pm" To: drosih@rpi.edu (Garance A Drosihn) Date: Thu, 9 Jul 1998 11:15:28 -0700 (PDT) Cc: freebsd-current@FreeBSD.ORG X-Mailer: ELM [version 2.4ME+ PL31 (25)] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-current@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Garance A Drosihn writes: > >>The following small program: > >> > >> main(){while(1) fork();} > >> > >> is a very effective denial of service attack against FreeBSD-2.2.6, > >> despite reasonable defaults in login.conf. The problem is *not* the > >> number of processes, but the system call rate. It's actually kind of > >> amazing to follow this with vmstat, and see that the box is suddenly > >> doing 395000 system calls per second :-) (this is a P-166). > > The subject of this thread asks about adding a rate-limit for > system calls. I don't think that's a good idea, but I would like > to see some kind of throttling of calls to fork() in particular. Why would 100 processes doing main(){while(1) getpid();} be accounted for any differently than 100 processes doing main(){while(1) /* infinite loop in user mode */;} ? Or am I misunderstanding something. -Archie ___________________________________________________________________________ Archie Cobbs * Whistle Communications, Inc. * http://www.whistle.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-current" in the body of the message