From owner-freebsd-security  Wed Jan 24  7:18:38 2001
Delivered-To: freebsd-security@freebsd.org
Received: from liberty.bulinfo.net (liberty.bulinfo.net [212.72.195.7])
	by hub.freebsd.org (Postfix) with SMTP id 3CE3D37B400
	for <freebsd-security@freebsd.org>; Wed, 24 Jan 2001 07:18:18 -0800 (PST)
Received: (qmail 58371 invoked from network); 24 Jan 2001 15:18:09 -0000
Received: from pythia.bulinfo.net (HELO bulinfo.net) (212.72.195.5)
  by liberty.bulinfo.net with SMTP; 24 Jan 2001 15:18:09 -0000
Message-ID: <3A6EF228.60C10497@bulinfo.net>
Date: Wed, 24 Jan 2001 17:18:00 +0200
From: Krassimir Slavchev <krassi@bulinfo.net>
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.13 i686)
X-Accept-Language: en
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Subject: Re: DoS: socket: No buffer space available
References: <01012417332701.31962@localhost.localdomain>
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org

Hi,
Can you provide output of netstat -m?

"Mr. Blackman" wrote:

> Hello!
>
> Last days our server was DoSed (I'm sure).
> Ok, facts:
> The Problem:
> IP socket: No buffer space available
> UNIX Socket : No buffer space available
>
> Victim: FreeBSD 3.4
> Kernel compiled with these options:
> options         ICMP_BANDLIM
> options         TCP_DROP_SYNFIN
> options         TCP_RESTRICT_RST
> options         IPFIREWALL
> options         IPFIREWALL_VERBOSE
> options         IPFIREWALL_VERBOSE_LIMIT=10
>
> /etc/rc.conf:
> tcp_drop_synfin="YES"
> tcp_restrict_rst="YES"
> icmp_drop_redirect="YES"
> icmp_log_redirect="YES"
> firewall_enable="YES"
> firewall_script="/etc/rc.firewall"
> firewall_type="/etc/rc.firewall"
> firewall_quiet="NO"
>
> ### TCP STACK TUNING ###
> # TCP send/receive spaces
> sysctl -w net.inet.tcp.sendspace=32768
> sysctl -w net.inet.tcp.recvspace=32768
> # Socket queue defense against SYN attacks
> sysctl -w kern.ipc.somaxconn=1024   #!!!
> sysctl -w net.inet.icmp.drop_redirect=1
> sysctl -w net.inet.icmp.log_redirect=1
> sysctl -w net.inet.ip.redirect=0
> sysctl -w net.inet6.ip6.redirect=0
> sysctl -w net.link.ether.inet.max_age=1200
> sysctl -w net.inet.ip.sourceroute=0
> sysctl -w net.inet.ip.accept_sourceroute=0
> sysctl -w net.inet.icmp.bmcastecho=0
> sysctl -w net.inet.icmp.maskrepl=0
> ### END TCP STACK TUNING ###
>
> On this server all packets are filtered with IPFW and _all_, except 53 udp are
> in "deny".
>
> Yes, I know about "named DoS", but the server is completely down.
> And only reboot solve the problem.
>
> Where is the problem, where is salvation?:)
>
> Thank you for attention.
>
> Mr. Blackman, Security Officer.
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message





To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message