From owner-freebsd-security@FreeBSD.ORG  Sat Aug 28 16:16:15 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id AAD2116A4CE
	for <freebsd-security@freebsd.org>;
	Sat, 28 Aug 2004 16:16:15 +0000 (GMT)
Received: from vista.netmemetic.com (bb-203-125-44-190.singnet.com.sg
	[203.125.44.190])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 600BB43D64
	for <freebsd-security@freebsd.org>;
	Sat, 28 Aug 2004 16:16:15 +0000 (GMT)
	(envelope-from ngps@netmemetic.com)
Received: by vista.netmemetic.com (Postfix, from userid 100)
	id 863C880D; Sun, 29 Aug 2004 00:15:59 +0800 (SGT)
Date: Sun, 29 Aug 2004 00:15:59 +0800
From: Ng Pheng Siong <ngps@netmemetic.com>
To: Andrew McNaughton <andrew@scoop.co.nz>
Message-ID: <20040828161559.GG576@vista.netmemetic.com>
References: <20040827002100.GB653@vista.netmemetic.com>
	<20040827181034.G6278@a2.scoop.co.nz>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20040827181034.G6278@a2.scoop.co.nz>
User-Agent: Mutt/1.4.1i
cc: freebsd-security@freebsd.org
Subject: Re: ipfw core dump
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 28 Aug 2004 16:16:15 -0000

On Fri, Aug 27, 2004 at 06:12:28PM +1200, Andrew McNaughton wrote:
> Is ipfw in your jail in sync with the kernel?

It should be.

Gdb'ing the core file shows a bunch of "???". 

Anyways, thank you and all others for your suggestions. 

It has happened again, and the core file registered the same time, at
3.01am. I'm conjecturing that this is caused by the periodic/security stuff
in one of 500.ipfwdenied or 550.ipfwlimit. Maybe a bug in ipfw.

Does this ring a bell with anyone?

Thanks. Cheers.

-- 
Ng Pheng Siong <ngps@netmemetic.com> 

http://firewall.rulemaker.net -+- Cisco PIX & Netscreen Config Version Control 
http://sandbox.rulemaker.net/ngps -+- M2Crypto, ZServerSSL for Zope, Blog