Date: Wed, 26 Jan 2000 20:55:50 -0700 (MST) From: Brett Glass <brett@lariat.org> To: security@freebsd.org Subject: Riddle me this Message-ID: <200001270355.UAA01355@lariat.lariat.org>
next in thread | raw e-mail | index | archive | help
A fellow here in town asked me to look at a machine which he thought had been attacked. Sure enough, when I checked the logs, I saw Jan 24 19:18:59 victim /kernel: icmp-response bandwidth limit 108/100 pps Jan 24 19:19:37 victim /kernel: icmp-response bandwidth limit 115/100 pps Jan 24 19:19:38 victim /kernel: icmp-response bandwidth limit 131/100 pps Jan 24 19:19:39 victim /kernel: icmp-response bandwidth limit 135/100 pps Jan 24 19:19:40 victim /kernel: icmp-response bandwidth limit 104/100 pps Jan 24 19:20:12 victim /kernel: icmp-response bandwidth limit 146/100 pps Jan 24 19:20:13 victim /kernel: icmp-response bandwidth limit 127/100 pps Jan 24 19:20:14 victim /kernel: icmp-response bandwidth limit 127/100 pps Jan 24 19:20:15 victim /kernel: icmp-response bandwidth limit 118/100 pps which means that ICMP bandwidth limiting had kicked in. Probably stream.c, I thought. While this seemed to be keeping the system alive, I noted that the machine was also acting as a router for a private subnet with some Windows machines on it. So, since multicast IP wasn't in use, I added IPFW rules that blocked multicast addresses on all interfaces: 00049 deny ip from 224.0.0.0/4 to any via any 00050 deny ip from any to 224.0.0.0/4 via any So far, so good. But a couple of days later, when I checked the logs, I saw: Jan 26 15:23:49 victim natd[125]: failed to write packet back (No route to host) Maybe I'm just dense this evening and the cause of the message is obvious, but I can't figure out what would have generated this message. The system has a static default route to the upstream ISP's router. Is this a side effect of the rules I added? Or of something else? --Brett Glass To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001270355.UAA01355>