[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

bogus SYN flood?



Howdy...

I came home to find my workstation thrashing - errors are appended to this
message.  Kerneld was consuming over 50meg of memory, so I bounced it,
which seems to have cleared the problem up.

Overmind is a P90, 2.0.32 and is fairly well synced with Hamm.  Modutils
is 2.1.55-4.  Current uptime is almost 13 days.  The machine was idle at
the time.

I've been unsubscribed from linux-kernel since before 2.0.32 came out,
so I don't know if this problem has been discussed over there.  I just
resubscribed.

PeeWee

Full transcript of errors from /var/adm/messages follows:

Dec  5 14:30:01 overmind kernel: validated probe(127.0.0.1:726, 127.0.0.1:778, -580073059) 
Dec  5 14:45:01 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 14:45:01 overmind kernel: validated probe(127.0.0.1:804, 127.0.0.1:778, 1528032577) 
Dec  5 15:00:02 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 15:00:03 overmind kernel: validated probe(127.0.0.1:871, 127.0.0.1:778, -1098321254) 
Dec  5 15:05:05 overmind kernel: flushed 1084 old SYSVIPC messages<1>Ouch, no kerneld for message 2147442165 
Dec  5 15:15:01 overmind kernel: flushed 1086 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 15:15:01 overmind kernel: validated probe(127.0.0.1:942, 127.0.0.1:778, -1341543110) 
Dec  5 15:30:00 overmind kernel: flushed 1079 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 15:30:01 overmind kernel: validated probe(127.0.0.1:1000, 127.0.0.1:778, 754024873) 
Dec  5 15:45:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 15:45:01 overmind kernel: validated probe(127.0.0.1:640, 127.0.0.1:778, -2079395917) 
Dec  5 16:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 16:00:01 overmind kernel: validated probe(127.0.0.1:696, 127.0.0.1:778, 521267003) 
Dec  5 16:05:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 16:05:01 overmind kernel: validated probe(127.0.0.1:720, 127.0.0.1:778, -1748167046) 
Dec  5 16:05:07 overmind kernel: Ouch, no kerneld for message 2147442166 
Dec  5 16:15:00 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 16:15:01 overmind kernel: validated probe(127.0.0.1:766, 127.0.0.1:778, 891621602) 
Dec  5 16:30:00 overmind kernel: flushed 1083 old SYSVIPC messages<4>flushed 1080 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 16:30:00 overmind kernel: validated probe(127.0.0.1:824, 127.0.0.1:778, 723969002) 
Dec  5 16:45:00 overmind kernel: flushed 1085 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 16:45:00 overmind kernel: validated probe(127.0.0.1:887, 127.0.0.1:778, 29768560) 
Dec  5 17:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 17:00:01 overmind kernel: validated probe(127.0.0.1:946, 127.0.0.1:778, 525624201) 
Dec  5 17:05:01 overmind kernel: Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 17:05:01 overmind kernel: validated probe(127.0.0.1:970, 127.0.0.1:778, -1800602240) 
Dec  5 17:05:05 overmind kernel: Ouch, no kerneld for message 2147442167 
Dec  5 17:15:01 overmind kernel: flushed 1082 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 17:15:01 overmind kernel: validated probe(127.0.0.1:1016, 127.0.0.1:778, 1304971566) 
Dec  5 17:30:00 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1081 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 17:30:00 overmind kernel: validated probe(127.0.0.1:650, 127.0.0.1:778, -1483188710) 
Dec  5 17:45:01 overmind kernel: flushed 1085 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 17:45:01 overmind kernel: validated probe(127.0.0.1:714, 127.0.0.1:778, -1528760368) 
Dec  5 18:00:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 18:00:01 overmind kernel: validated probe(127.0.0.1:770, 127.0.0.1:778, -2043635234) 
Dec  5 18:05:02 overmind kernel: flushed 1086 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 18:05:02 overmind kernel: validated probe(127.0.0.1:796, 127.0.0.1:778, -1704133901) 
Dec  5 18:05:06 overmind kernel: Ouch, no kerneld for message 2147442168 
Dec  5 18:15:01 overmind kernel: flushed 1084 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 18:15:01 overmind kernel: validated probe(127.0.0.1:842, 127.0.0.1:778, -1038744631) 
Dec  5 18:30:02 overmind kernel: flushed 1081 old SYSVIPC messages<4>flushed 1083 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 18:30:02 overmind kernel: validated probe(127.0.0.1:900, 127.0.0.1:778, -1178759874) 
Dec  5 18:45:01 overmind kernel: flushed 1086 old SYSVIPC messages<4>flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 18:45:01 overmind kernel: validated probe(127.0.0.1:963, 127.0.0.1:778, -451385194) 
Dec  5 19:00:01 overmind kernel: flushed 1085 old SYSVIPC messages<6>Warning: possible SYN flood from 127.0.0.1 on 127.0.0.1:778.  Sending cookies. 
Dec  5 19:00:01 overmind kernel: validated probe(127.0.0.1:1019, 127.0.0.1:778, -1372676457) 
Dec  5 19:05:04 overmind kernel: flushed 1084 old SYSVIPC messages<1>Ouch, no kerneld for message 2147442169 

-- 
"Learn to knit for all I care, but find something rhythmical to do before bed" 
-Amanda Robinson -- personal: peewee@scc.mi.org  http://www.scc.mi.org/peewee/
work: jwright@us.checkpoint.com finger peewee@msen.com for pgp2.6.2 public key


--
TO UNSUBSCRIBE FROM THIS MAILING LIST: e-mail the word "unsubscribe" to
debian-user-request@lists.debian.org . Trouble? 
e-mail to templin@bucknell.edu .


Reply to: