From owner-freebsd-stable Mon Sep 20 8:24:31 1999 Delivered-To: freebsd-stable@freebsd.org Received: from flood.ping.uio.no (flood.ping.uio.no [129.240.78.31]) by hub.freebsd.org (Postfix) with ESMTP id 1410114CB8; Mon, 20 Sep 1999 08:24:22 -0700 (PDT) (envelope-from des@flood.ping.uio.no) Received: (from des@localhost) by flood.ping.uio.no (8.9.3/8.9.3) id RAA71406; Mon, 20 Sep 1999 17:23:51 +0200 (CEST) (envelope-from des) To: "Joao Carlos" Cc: , , , Subject: Re: Out of mbuf clusters References: <000501bf030a$ac70e7a0$fa58dfc8@bahianet.com.br> From: Dag-Erling Smorgrav Date: 20 Sep 1999 17:23:50 +0200 In-Reply-To: "Joao Carlos"'s message of "Sun, 19 Sep 1999 22:51:35 -0300" Message-ID: Lines: 46 X-Mailer: Gnus v5.5/Emacs 19.34 Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG "Joao Carlos" writes: > I'm running FreeBSD 3.3-STABLE, and compiled a kernel with 64 maxusers. It > gives me somethink like 1048 processes. I don't know if it's a bug, or > whatever, but i got crazy when i tested a program called CLONE on a IRC > Server running i this machine. > Before arriving 1024 connections on te IRCD, (NOTE: nothing more like httpd, > squid, etc were running), The machine crashed, with the following message: I'll bet your CLONE thingy wasn't properly written, and doesn't actually consume the data sent by the server, causing the server to fill up mbufs. Currently, FreeBSD panics when it runs out of mbufs. 1) use ircd connection classes to prevent clients from opening more than a small number of connections, and to limit the size of the send queue. If you don't know what that means, don't run an IRC server. 2) increase the number of mbuf clusters. If you don't know how to do this, don't run an IRC server. 3) set up a heavy firewall in front of your server (preferably on your border router) which protects your server from SYN floods, UDP floods, smurfing fingerprinting, etc. If you don't know how to do this, don't run an IRC server. 4) harden your TCP/IP stack to withstand SYN floods, UDP floods, smurfing, fingerprinting, etc. Run a recent 4.0, or 3.3-R with my hardening patches, and understand what those patches do and how to use them. If you don't know how to do this, don't run an IRC server. 5) lock your machine down tight, including disabling all services except ircd and ssh and configuring sshd to only accept connections from trusted hosts and require RSA authentication (no rhosts, no password authentication). If you don't know how to do this, don't run an IRC server. 6) if you need a flooder, try my joiner.pl. Read the source and understand how it works and how to tune it before using it. Know that it can (and will) crash your server if you didn't do 1) and 2) properly. If you don't know how to do this, don't run an IRC server. DES -- Dag-Erling Smorgrav - des@flood.ping.uio.no To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message