From owner-freebsd-questions Wed Aug 11 12: 1:37 1999 Delivered-To: freebsd-questions@freebsd.org Received: from alice.gba.oz.au (gba-254.tmx.com.au [203.9.155.254]) by hub.freebsd.org (Postfix) with SMTP id D91C915585 for ; Wed, 11 Aug 1999 12:01:24 -0700 (PDT) (envelope-from gjb-freebsd@gba.oz.au) Received: (qmail 8383 invoked by uid 1001); 12 Aug 1999 03:19:43 +1000 Message-ID: <19990811171943.8382.qmail@alice.gba.oz.au> X-Posted-By: GBA-Post 1.03 20-Sep-1998 X-PGP-Fingerprint: 5A91 6942 8CEA 9DAB B95B C249 1CE1 493B 2B5A CE30 Date: Thu, 12 Aug 1999 03:19:42 +1000 From: Greg Black To: Doug White Cc: Donald Burr , FreeBSD Questions , FreeBSD Security Subject: Re: umountall requests - what does this all mean? References: In-reply-to: of Mon, 09 Aug 1999 16:39:42 MST Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG Doug White writes: > > Aug 7 19:04:49 60-Hz mountd[150]: umountall request from 207.71.226.193 from unprivileged port > > > > 207.71.226.193 is the IP addressed assigned to me by my ADSL provider, so > > I can only assume that these packets are coming in through the ADSL modem. > > > > What do these messages mean, and should I be worried about them? And how > > do I block them? > > What IP is 60-Hz? > > It's probably another machine trying to dismount partitions and mountd > doesn't recognize it. Probably harmless. I got some similar messages on a 3.2 box a couple of days ago. At the time it was connected only to my home LAN and no machines outside of my office were physically connected to the LAN for some hours before or after the messages appeared. I was doing some NFS mounts to that box, but there was no genuine umount request at the time the message appeared. In fact, now that I check the log, the IP that the alleged request came from was the IP of the host that complained -- there was no umount ever done on the box that day. I would have looked at it a bit harder, but I was in the middle of determining why the box was suffering repeated panics. Since each panic took 45 minutes to induce and it took ten panics and a few new kernels to find a solution and a few more iterations of my test to feel confident that the panics were over, and this minor detail got ignored. The umountall notices came in the following sequence [I've folded long lines and indented the continuations]: Aug 10 12:30:37 bambi /kernel: changing root device to wd0s1a Aug 10 12:30:37 bambi named[102]: starting. named 8.1.2 Tue May 18 03:29:06 GMT 1999 jkh@cathair:/usr/obj/usr/src/usr.sbin/named Aug 10 12:30:37 bambi named[103]: Ready to answer queries. Aug 10 12:31:33 bambi login: ROOT LOGIN (root) ON ttyv0 Aug 10 12:54:39 bambi mountd[120]: umountall request from 192.168.1.12 from unprivileged port Aug 10 12:54:43 bambi mountd[120]: umountall request from 192.168.1.12 from unprivileged port Aug 10 13:05:21 bambi mountd[120]: mount request succeeded from 192.168.1.52 for /gba2 Aug 10 13:37:16 bambi /kernel: Out of mbuf clusters - adjust NMBCLUSTERS or increase maxusers! Aug 10 13:37:16 bambi /kernel: xl0: no memory for rx list -- packet dropped! The first line is the end of the immediately previous reboot after the previous panic. The log continues in full up to the next panic. The root login at 12:31 was genuine and it was partly to ensure that the DNS stuff was all working correctly. The IP of the machine in question (bambi) was 192.168.1.12. The two umountall lines from that same IP at 12:54:{39,43} were spurious. The mount from 192.168.1.52 was the NFS mount that I ran as part of the next test that was destined to crash the machine 32 minutes later when it ran out of mbufs. Nothing else was happening at the time. These messages did not appear during any other tests. -- Greg Black -- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message