From owner-freebsd-security Mon Aug 28 11:13: 3 2000 Delivered-To: freebsd-security@freebsd.org Received: from fw.wintelcom.net (ns1.wintelcom.net [209.1.153.20]) by hub.freebsd.org (Postfix) with ESMTP id 9201837B424 for ; Mon, 28 Aug 2000 11:13:01 -0700 (PDT) Received: (from bright@localhost) by fw.wintelcom.net (8.10.0/8.10.0) id e7SICtP13588; Mon, 28 Aug 2000 11:12:55 -0700 (PDT) Date: Mon, 28 Aug 2000 11:12:54 -0700 From: Alfred Perlstein To: "Col.Panic" Cc: freebsd-security@FreeBSD.ORG Subject: Re: your mail (fwd) Message-ID: <20000828111254.S1209@fw.wintelcom.net> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.4i In-Reply-To: ; from panic@satan.antix.org on Mon, Aug 28, 2000 at 11:09:02AM -0700 Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org > > Sep 19 00:17:56 shell /kernel: icmp-response bandwidth limit 3505/200 pps > > Sep 19 00:17:57 shell /kernel: icmp-response bandwidth limit 3503/200 pps > > Sep 19 00:17:58 shell /kernel: icmp-response bandwidth limit 3505/200 pps > > Sep 19 00:17:59 shell /kernel: icmp-response bandwidth limit 3502/200 pps * Col.Panic [000828 11:09] wrote: > I have an interesting appendage to add to this answer. I have ICMP shut > down at the router, and I get the same messages from my new 4.1-STABLE > system. I can understand if somebody is spoofing ICMP packets, but if > they are, how are the replies getting to my machine? > > I've looked into it, and there isn't anybody logged into the machine for > when this occurs. I'm at a loss. It's an icmp _response_ limit, meaning it limits the amount of icmp error messages your machine will generate in repsonse to bogus connections or listen queue overflows. most likely an ACK/SYN attack of some sort or a server unable to handle its listen queue (incomiming connections) -Alfred To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message