Date: Wed, 18 Oct 2006 13:45:03 -0700 From: Jeremy Chadwick <freebsd@jdc.parodius.com> To: "Andresen, Jason R." <jandrese@mitre.org> Cc: freebsd-stable@freebsd.org Subject: Re: Runaway kernel? Or an attack? Message-ID: <20061018204503.GB47563@icarus.home.lan> In-Reply-To: <F9F038204EE77C4AA9959A6B3C94AFE8F99CB8@IMCSRV2.MITRE.ORG> References: <F9F038204EE77C4AA9959A6B3C94AFE8F99CB8@IMCSRV2.MITRE.ORG>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Oct 18, 2006 at 04:07:14PM -0400, Andresen, Jason R. wrote:
> Ok, I have a recurring problem with my webserver. Once a day or so it
> gets locked into a loop with some random server usually somewhere in my
> ISP. When it does this, it spends all of its time spitting out packets
> and getting FIN, ACKs back.
>
> Shutting down the HTTP server doesn't stop the traffic. I have to
> create firewall rules to block the outgoing traffic to stop it. Wiping
> the disk and reinstalling from the CD didn't help either. This host is
> behind a NAT (A D-Link DI-604 router). Is this a bad packet injection
> attack, a bug, or has my box been compromised?
And let me guess: your DI-604 is set to port forward TCP 80 to
192.168.42.2 (rather than make 192.168.42.2 the DMZ host).
I recommend removing the DI-604 from the topology and see if the
problem continues. Gut feeling (based on past experience with
D-Link's residential products) is the problem will disappear.
You'll have to trust me on this -- no matter how reliable you think
the DI-series units are ("It works fine for me!"), they aren't.
There are major IP stack implementation issues with these units
(same with the DI-614+).
Thoroughly scan the D-Link forum on www.broadbandreports.com for
details of these problems. The IP stack on those units is awful.
Consider picking up a WRT54GL (which runs Linux; sure, I'd prefer
they run BSD, but I'll trust Linux's IP stack over some third-party
out-of-country IP stack any day of the week). Do not go with a
WRT54G (because you won't know what version you get; Linux-based
or VxWorks-based (which has other IP stack problems), nor a WRT54GS
(same risk (Linux vs. VxWorks)).
--
| Jeremy Chadwick jdc at parodius.com |
| Parodius Networking http://www.parodius.com/ |
| UNIX Systems Administrator Mountain View, CA, USA |
| Making life hard for others since 1977. PGP: 4BD6C0CB |
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061018204503.GB47563>