From owner-freebsd-hackers Sun Aug 19 13:54:14 2001 Delivered-To: freebsd-hackers@freebsd.org Received: from digitaldaemon.com (digitaldaemon.com [63.105.9.34]) by hub.freebsd.org (Postfix) with SMTP id 1033037B408 for ; Sun, 19 Aug 2001 13:53:53 -0700 (PDT) (envelope-from jan@digitaldaemon.com) Received: (qmail 82840 invoked from network); 19 Aug 2001 20:51:31 -0000 Received: from unknown (HELO digitaldaemon.com) (192.168.0.73) by digitaldaemon.com with SMTP; 19 Aug 2001 20:51:31 -0000 Message-ID: <3B8026CC.9090805@digitaldaemon.com> Date: Sun, 19 Aug 2001 16:51:24 -0400 From: Jan Knepper User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1 X-Accept-Language: en-us MIME-Version: 1.0 To: FreeBSD Hackers Subject: [Fwd: Re: slashdotted: /kernel: xl0: no memory for rx list -- packet dropped!] Content-Type: multipart/alternative; boundary="------------060100050103050904050209" Sender: owner-freebsd-hackers@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG --------------060100050103050904050209 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Hi! Does anyone here know what to do about this? Thanks! Jan -------- Original Message -------- From: - Sat Aug 18 12:19:58 2001 X-UIDL: 998151141.23696.digitaldaemon.com,S=3760 X-Mozilla-Status: 0013 X-Mozilla-Status2: 00000000 Return-Path: Delivered-To: jan@digitaldaemon.com Received: (qmail 23693 invoked from network); 18 Aug 2001 16:12:20 -0000 Received: from unknown (HELO sm4.texas.rr.com) (root@24.93.35.211) by digitaldaemon.com with SMTP; 18 Aug 2001 16:12:20 -0000 Received: from [192.168.0.138] (cs6668179-144.austin.rr.com [66.68.179.144]) by sm4.texas.rr.com (8.12.0.Beta5/8.12.0.Beta5) with ESMTP id f7IGE8KE018133; Sat, 18 Aug 2001 11:14:08 -0500 User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022 Date: Sat, 18 Aug 2001 11:14:12 -0500 Subject: Re: slashdotted: /kernel: xl0: no memory for rx list -- packet dropped! From: "Michael C. Wu" To: Jan Knepper , FreeBSD ISP Message-ID: In-Reply-To: <3B7E9205.7010604@digitaldaemon.com> Mime-version: 1.0 Content-type: text/plain; charset="US-ASCII" Content-transfer-encoding: 7bit on 08/18/2001 11:04 AM, Jan Knepper at jan@digitaldaemon.com wrote: > Last Thursday one of the sites I host got slashdotted > (http://www.slashdot.com/) and amazingly FreeBSD 4.3 on PIII 600 Mhz > with 128 MB RAM took the load gracefully. I.e. until around 5 PM EST > when I got messages like: This should a good enough system. > /kernel: xl0: no memory for rx list -- packet dropped! > > at the console... > > So what I did is, I terminated some of the daemon's that were not really > used as a couple of httpd server, etc. This seemed to solve the problem, > however... When I run a netstat -na right now I get the impression that > there is still some garbadge in memory from this experience: > > As: > tcp4 0 15360 63.105.9.61.20 217.80.179.220.2822 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.219.43.81.2591 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.2535 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.1736 LAST_ACK > tcp4 0 15360 63.105.9.61.20 200.11.220.5.1735 LAST_ACK > tcp4 0 15360 63.105.9.61.20 202.133.131.44.3651 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.4486 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.4338 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.3452 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.3449 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1825 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2922 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2390 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.2310 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1598 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1597 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1556 LAST_ACK > tcp4 0 15360 63.105.9.61.20 193.124.148.213.1553 LAST_ACK > tcp4 0 15360 63.105.9.61.20 203.195.181.4.1440 LAST_ACK > > I am sure this has been in there the last at least 24 hours and I can > see nothing is happening. I suspect that this is because of the no > memory for rx list, but I am not quite sure. I was kinda a cool feeling > though that FreeBSD didn't give up, but still runs!!! I think you might have been attacked by a well-known attack, simply named the LAST_ACK attack. It puts our TCP state machine into whack by not sending the proper TCP states. There is no way around it. > Is there anyway to clean this up without having to reboot the system? I don't know. :) -- keichiii@iteration.net --------------060100050103050904050209 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi!

Does anyone here know what to do about this?

Thanks!
Jan



-------- Original Message --------
From: - Sat Aug 18 12:19:58 2001
X-UIDL: 998151141.23696.digitaldaemon.com,S=3760
X-Mozilla-Status: 0013
X-Mozilla-Status2: 00000000
Return-Path: <keichii@iteration.net>
Delivered-To: jan@digitaldaemon.com
Received: (qmail 23693 invoked from network); 18 Aug 2001 16:12:20 -0000
Received: from unknown (HELO sm4.texas.rr.com) (root@24.93.35.211) by digitaldaemon.com with SMTP; 18 Aug 2001 16:12:20 -0000
Received: from [192.168.0.138] (cs6668179-144.austin.rr.com [66.68.179.144]) by sm4.texas.rr.com (8.12.0.Beta5/8.12.0.Beta5) with ESMTP id f7IGE8KE018133; Sat, 18 Aug 2001 11:14:08 -0500
User-Agent: Microsoft-Outlook-Express-Macintosh-Edition/5.02.2022
Date: Sat, 18 Aug 2001 11:14:12 -0500
Subject: Re: slashdotted: /kernel: xl0: no memory for rx list -- packet dropped!
From: "Michael C. Wu" <keichii@iteration.net>
To: Jan Knepper <jan@digitaldaemon.com>, FreeBSD ISP <FreeBSD-ISP@freebsd.org>
Message-ID: <B7A3FE84.F61%keichii@iteration.net>
In-Reply-To: <3B7E9205.7010604@digitaldaemon.com>
Mime-version: 1.0
Content-type: text/plain; charset="US-ASCII"
Content-transfer-encoding: 7bit 


on 08/18/2001 11:04 AM, Jan Knepper at jan@digitaldaemon.com wrote:
> Last Thursday one of the sites I host got slashdotted
> (http://www.slashdot.com/) and amazingly FreeBSD 4.3 on PIII 600 Mhz
> with 128 MB RAM took the load gracefully. I.e. until around 5 PM EST
> when I got messages like:

This should a good enough system.
 
> /kernel: xl0: no memory for rx list -- packet dropped!
> 
> at the console...
> 
> So what I did is, I terminated some of the daemon's that were not really
> used as a couple of httpd server, etc. This seemed to solve the problem,
> however... When I run a netstat -na right now I get the impression that
> there is still some garbadge in memory from this experience:
> 
> As:
> tcp4       0  15360  63.105.9.61.20         217.80.179.220.2822    LAST_ACK
> t
cp4       0  15360  63.105.9.61.20         193.219.43.81.2591     LAST_ACK
> tcp4       0  15360  63.105.9.61.20         200.11.220.5.2535      LAST_ACK
> tcp4       0  15360  63.105.9.61.20         200.11.220.5.1736      LAST_ACK
> tcp4       0  15360  63.105.9.61.20         200.11.220.5.1735      LAST_ACK
> tcp4       0  15360  63.105.9.61.20         202.133.131.44.3651    LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.4486   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.4338   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.3452   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.3449   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.1825   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.2922   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.2390   LAST_ACK
> tcp4       0  15360
  63.105.9.61.20         193.124.148.213.2310   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.1598   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.1597   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.1556   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         193.124.148.213.1553   LAST_ACK
> tcp4       0  15360  63.105.9.61.20         203.195.181.4.1440     LAST_ACK
> 
> I am sure this has been in there the last at least 24 hours and I can
> see nothing is happening. I suspect that this is because of the no
> memory for rx list, but I am not quite sure. I was kinda a cool feeling
> though that FreeBSD didn't give up, but still runs!!!

I think you might have been attacked by a well-known attack, simply named
the LAST_ACK attack.  It puts our TCP state machine into whack by not
sending the proper TCP states.  There is no way around it.
 
> Is there anyway to clean thi
s up without having to reboot the system?

I don't know. :)
-- 
keichiii@iteration.net
--------------060100050103050904050209-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-hackers" in the body of the message