From owner-freebsd-security Fri May 21 1:32: 1 1999 Delivered-To: freebsd-security@freebsd.org Received: from amanda.qmpgmc.ac.uk (amanda.qmpgmc.ac.uk [194.81.5.1]) by hub.freebsd.org (Postfix) with ESMTP id 3345F151F1 for ; Fri, 21 May 1999 01:31:53 -0700 (PDT) (envelope-from greg@qmpgmc.ac.uk) Received: from greg (gquinlan [194.81.0.56]) by amanda.qmpgmc.ac.uk (8.9.3/8.9.3) with SMTP id JAA01079 for ; Fri, 21 May 1999 09:31:52 +0100 (BST) Message-ID: <001f01bea364$57d9c820$380051c2@greg.qmpgmc.ac.uk> Reply-To: "Greg Quinlan" From: "Greg Quinlan" To: Subject: Server trying to connect to Port 113 Date: Fri, 21 May 1999 09:31:37 +0100 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org I am not on the mailing list so please include me in your reply. Can someone explain what this remote system is trying to do? May 21 09:22:14 amanda /kernel: ipfw: 24110 Deny TCP :1937 :113 in via fxp1 May 21 09:22:35 amanda last message repeated 3 times Extract from /etc/services auth 113/tcp ident tap #Authentication Service auth 113/udp ident tap #Authentication Service Greg -----Original Message----- From: Andrew McNaughton To: junkmale@xtra.co.nz Cc: freebsd-security@FreeBSD.ORG Date: 18 May 1999 23:34 Subject: Re: http attack(?) >> A few days ago, I noticed my machine was running extremely slowly. I did a top 10 at the console and >> got "too many open files". Existing telnet sessions were non-responsive. New telnets would not start. >> >> I then tried a top 5. named and syslogd were busy. >> >> I looked at httpd.error and 21 of these spread over 14 seconds: >> [Sat May 15 16:45:34 1999] accept: (client socket): Too many open files in system > >I'm not too sure whether to trust that the restriction on file handles is system wide. Some programs may not know about FreeBSD's process limits scheme. > >Check the output of 'limits' and 'sysctl -a | grep maxfiles'. They might give you a better idea what is happening. The context in which you run limits is important, but if your shell is failing, then that shell is probably a good thing to have a look at. limits is a shell built-in under sh and bash, and will not spawn a new process. > >Andrew McNaughton >-- >----------- >Andrew McNaughton >andrew@squiz.co.nz >http://www.newsroom.co.nz/ > > > > >To Unsubscribe: send mail to majordomo@FreeBSD.org >with "unsubscribe freebsd-security" in the body of the message > To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message