Re: ** VERY WEIRD ATTACK ?? **

[Hugh Graham <hugh@openbsd.org>]

On Wed, Feb 02, 2000 at 08:22:27PM -0700, Jason L. Schwab wrote:
> My machine is running named 4.9.7 (OpenBSD 2.6 with custom kernel)
> 
> this has happened twice now.... 
> 
> Each time this happens, my box totally freaks out, doesn't lock up
> or die per say, but all network connections instantly die. cant even
> ping it till about 5-10 mins later and its back again just like normal.
> 
> 
> any ideas? Thanks!
> 
> 
<a log of named complaining about sendto returning ENOBUFS deleted>

It's only an educated guess, but I'll wager this is not named's
fault. Most likely your machine was under some generic DoS attack
which saturated your link. Named complained because it noticed it
couldn't send to the network as it went about its normal named
business. I'd expect to see other daemons complaining in such a
log though.

Check: ``netstat -ssp ip'' from  time to time, and see if it has
gone up in a burp after one of these loss of service episodes.

If you're pretty sure I'm wrong, the obvious check is to kill named
and see if the problem occurs again.

/Hugh