RE: possible network attack question
It is possible that you have a problem with a network card on the same segment that your machine is on (It could be the card in your machine too.) You really need to do an ethernet sniff to find out if the giant frames are all from the same ethernet address or if they are from different addresses. If they are all the same address replace the card with that address. If they are from different hardware addresses try replacing the card in your machine. If that doesn't sole the problem you need to look deeper into the network - cables, hubs, routers.
Since you indicated the errors are increasing in frequency I suspect a bad network card will be found somewhere on your network (if it hasn't failed totally by now).
While it may be considered "normal" by some people to receive giant ethernet packets, it is usually a sign of a problem somewhere. The only reason I can see someone saying it is normal is that it does not occur with enough frequency to justify spending time to track the problem down.
Good luck,
Pat Ouellette
Assistant Computer Engineer
Engineering College Computing
The University of Toledo
Toledo, Ohio 43606
USA
pouellet@eng.utoledo.edu
----------
From: G. Kapetanios
Sent: Tuesday, March 10, 1998 5:23 PM
To: debian-user@lists.debian.org
Subject: possible network attack question
Hi,
In the last few weeks I have been receiving the following message in
syslog with increasing frequency
Mar 10 22:19:46 garfield kernel: eth0: Oversized Ethernet frame spanned
multiple buffers, status 7fffceff!
I have been told that this is "normal" and should not worry me. However,
as the frequency has increased dramatically, I was wondering aboutwhat it
actually is and secondly whether it could be some sort of attack from the
net. I have the iplogger package and it reports nothing suspicious. Could
it be something that iplogger is not designed to notice ? Any help would
be appreacited as this is really buffling me
Thanks
George
-------------------------------------------------------------------------------
George Kapetanios
Churchill College
Cambridge, CB3 0DS E-Mail: GK205@cus.cam.ac.uk
U.K. WWW: http://garfield.chu.cam.ac.uk/~gk205/work_info.html
-------------------------------------------------------------------------------
--
E-mail the word "unsubscribe" to debian-user-request@lists.debian.org
TO UNSUBSCRIBE FROM THIS MAILING LIST. Trouble? E-mail to listmaster@debian.org .
--
E-mail the word "unsubscribe" to debian-user-request@lists.debian.org
TO UNSUBSCRIBE FROM THIS MAILING LIST. Trouble? E-mail to listmaster@debian.org .
Reply to: