Date: Wed, 10 Jan 2007 16:30:31 +0100 From: Ivan Voras <ivoras@fer.hr> To: freebsd-questions@freebsd.org Subject: Re: Simple DoS Message-ID: <eo30qo$cm7$1@sea.gmane.org> In-Reply-To: <45A4FDDA.8040909@skoberne.net> References: <45A4FDDA.8040909@skoberne.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Nejc Škoberne wrote: > Hello, > > yesterday one of our clients did something interesting (stupid): they > connected both ends of an UTP cable to the same switch, to which our > FreeBSD server was also connected. The server was immediately completely > unresponsive from yesterday evening until this morning, when our tech > guy went there to see what the problem was. Even when they rebooted > the FreeBSD machine, it wouldn't boot normally - disk I/O was very > busy and everything was happening unusably slow. After the disconnect > from that switch, everything went back to normal. > > Any ideas how to prevent such situations in the future? (I would like > to do it on the server side, not on the "user side".) First you need to identify what really happened. The story as you tell it has much unknown. What does the server do? Is it forwarding packets so they got stuck in a loop? High disk I/O suggests you have firewall enabled with logging, so every discarded (?) packet generated a log message. If you're using syslog you can tell it not to sync after every message and thus lower the I/O load. If you don't need to inspect the logs, disable the logging.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?eo30qo$cm7$1>