bogus SYN flood?
Howdy...
I came home to find my workstation thrashing - errors are appended to this
message. Kerneld was consuming over 50meg of memory, so I bounced it,
which seems to have cleared the problem up.
Overmind is a P90, 2.0.32 and is fairly well synced with Hamm. Modutils
is 2.1.55-4. Current uptime is almost 13 days. The machine was idle at
the time.
I've been unsubscribed from linux-kernel since before 2.0.32 came out,
so I don't know if this problem has been discussed over there. I just
resubscribed.
PeeWee
Full transcript of errors from /var/adm/messages follows:
Dec 5 14:30:01 overmind kernel: validated probe(127.0.0.1:726, 127.0.0.1:778, -580073059)
Dec 5 14:45:01 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 14:45:01 overmind kernel: validated probe(127.0.0.1:804, 127.0.0.1:778, 1528032577)
Dec 5 15:00:02 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 15:00:03 overmind kernel: validated probe(127.0.0.1:871, 127.0.0.1:778, -1098321254)
Dec 5 15:05:05 overmind kernel: flushed 1084 old SYSVIPC messages<1>Ouch, no kerneld for message 2147442165
Dec 5 15:15:01 overmind kernel: flushed 1086 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 15:15:01 overmind kernel: validated probe(127.0.0.1:942, 127.0.0.1:778, -1341543110)
Dec 5 15:30:00 overmind kernel: flushed 1079 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 15:30:01 overmind kernel: validated probe(127.0.0.1:1000, 127.0.0.1:778, 754024873)
Dec 5 15:45:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 15:45:01 overmind kernel: validated probe(127.0.0.1:640, 127.0.0.1:778, -2079395917)
Dec 5 16:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 16:00:01 overmind kernel: validated probe(127.0.0.1:696, 127.0.0.1:778, 521267003)
Dec 5 16:05:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 16:05:01 overmind kernel: validated probe(127.0.0.1:720, 127.0.0.1:778, -1748167046)
Dec 5 16:05:07 overmind kernel: Ouch, no kerneld for message 2147442166
Dec 5 16:15:00 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 16:15:01 overmind kernel: validated probe(127.0.0.1:766, 127.0.0.1:778, 891621602)
Dec 5 16:30:00 overmind kernel: flushed 1083 old SYSVIPC messages<4>flushed 1080 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 16:30:00 overmind kernel: validated probe(127.0.0.1:824, 127.0.0.1:778, 723969002)
Dec 5 16:45:00 overmind kernel: flushed 1085 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 16:45:00 overmind kernel: validated probe(127.0.0.1:887, 127.0.0.1:778, 29768560)
Dec 5 17:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 17:00:01 overmind kernel: validated probe(127.0.0.1:946, 127.0.0.1:778, 525624201)
Dec 5 17:05:01 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 17:05:01 overmind kernel: validated probe(127.0.0.1:970, 127.0.0.1:778, -1800602240)
Dec 5 17:05:05 overmind kernel: Ouch, no kerneld for message 2147442167
Dec 5 17:15:01 overmind kernel: flushed 1082 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 17:15:01 overmind kernel: validated probe(127.0.0.1:1016, 127.0.0.1:778, 1304971566)
Dec 5 17:30:00 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1081 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 17:30:00 overmind kernel: validated probe(127.0.0.1:650, 127.0.0.1:778, -1483188710)
Dec 5 17:45:01 overmind kernel: flushed 1085 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 17:45:01 overmind kernel: validated probe(127.0.0.1:714, 127.0.0.1:778, -1528760368)
Dec 5 18:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 18:00:01 overmind kernel: validated probe(127.0.0.1:770, 127.0.0.1:778, -2043635234)
Dec 5 18:05:02 overmind kernel: flushed 1086 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 18:05:02 overmind kernel: validated probe(127.0.0.1:796, 127.0.0.1:778, -1704133901)
Dec 5 18:05:06 overmind kernel: Ouch, no kerneld for message 2147442168
Dec 5 18:15:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 18:15:01 overmind kernel: validated probe(127.0.0.1:842, 127.0.0.1:778, -1038744631)
Dec 5 18:30:02 overmind kernel: flushed 1081 old SYSVIPC messages<4>flushed 1083 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 18:30:02 overmind kernel: validated probe(127.0.0.1:900, 127.0.0.1:778, -1178759874)
Dec 5 18:45:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 18:45:01 overmind kernel: validated probe(127.0.0.1:963, 127.0.0.1:778, -451385194)
Dec 5 19:00:01 overmind kernel: flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778. Sending cookies.
Dec 5 19:00:01 overmind kernel: validated probe(127.0.0.1:1019, 127.0.0.1:778, -1372676457)
Dec 5 19:05:04 overmind kernel: flushed 1084 old SYSVIPC messages<1>Ouch, no kerneld for message 2147442169
--
"Learn to knit for all I care, but find something rhythmical to do before bed"
-Amanda Robinson -- personal: peewee@scc.mi.org http://www.scc.mi.org/peewee/
work: jwright@us.checkpoint.com finger peewee@msen.com for pgp2.6.2 public key
--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-user-request@lists.debian.org . Trouble?
e-mail to templin@bucknell.edu .
Reply to: