Date: Mon, 13 Aug 2001 21:32:16 +0200 From: Barry Irwin <bvi@devco.net> To: incidents@securityfocus.org, net@freebsd.org Subject: FreeBSD NATd problems Message-ID: <20010813213216.I684@itouchlabs.com>
next in thread | raw e-mail | index | archive | help
Hi All Just wondering if anyone else has experiance the following problem: I have a number of networks running with FreeBSD firewalls providing a nat service to a number of hosts behind the wall itself. Both outgoing nat, and port_redirection is provided. THis has been running stabily for over a year. However in the last 10 days I have had a number of these natd mprocesses suddenly bloat ( looking at 48Megs upwards when they normally sit at around 700K-1Meg. Ping times to the firewalls ( infact any packets passing through the natd process are delayed, it seems to suffer a type of exponential decay, with the highest delay I have recorded being in the order of 240 seconds! At this kind of latency, network connectivity is non existant. One of the first signs of an impending slowdown is that DNS starts timing out. The firewalls are running prettey standard martian filters ( see Darft-manning-dusa03.txt) to filter out the majority of the cruft floating around. This has sofar impacted 4.0-Release, 4.1-RELEASE as well as 4.3-STABLE. Reviews of tcpdumps collected once slowdown has been noticed do not show any signs of strange activity. What I am wondering is , is there some new Scanning /DoS tool, which is causing natd to get its data structures in a knot, and thereby grow massively, in addition to the slowdown. Without having looked at the data structures in detail, it appears as tho there is a long linked list, that is getting exponentially grown, and therby accounting for the increas in memory usage, as well as the massively increased latency caused by performing lookups in the data structure chain. So back to the question, has anyone else hear/experianced/seen this ? Barry To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010813213216.I684>