Re: Network attack?

To: Paul Goyette <paul%whooppee.com@localhost>
Subject: Re: Network attack?
From: Tom Ivar Helbekkmo <tih%hamartun.priv.no@localhost>
Date: Wed, 26 Feb 2014 14:31:22 +0100
Paul Goyette <paul%whooppee.com@localhost> writes:

> But definitely thanks for the info - if (when) it happens again, I
> will try disabling the "transmission" stuff and see if the situation
> gets better.

Any news on this?  I get occasional crashes or hangs of an amd64 system
that serves as my main gateway, file server, mail server, etc, and uses
ipf to do firewalling and NAT between VLANs on a trunked interface.  The
risk seems to be related to network throughput, and greatly increased if
a host behind the gateway runs rtorrent.

Here are crash dumps I've collected:

barsoom# ls -ltr
total 8330038
-rw-------  1 root  wheel          5 Feb  2  2012 minfree
-rw-------  1 root  wheel  964278808 Jul 13 12:14 netbsd.9.core
-rw-------  1 root  wheel    1397481 Jul 13 12:14 netbsd.9
-rw-------  1 root  wheel  717959704 Jul 29 03:04 netbsd.10.core
-rw-------  1 root  wheel    1397481 Jul 29 03:04 netbsd.10
-rw-------  1 root  wheel  804144664 Aug 22 21:41 netbsd.11.core
-rw-------  1 root  wheel    1397481 Aug 22 21:41 netbsd.11
-rw-------  1 root  wheel  999393304 Sep 15 22:14 netbsd.12.core
-rw-------  1 root  wheel    1397481 Sep 15 22:14 netbsd.12
-rw-------  1 root  wheel  980252184 Oct  6 12:45 netbsd.13.core
-rw-------  1 root  wheel    1397481 Oct  6 12:45 netbsd.13
-rw-------  1 root  wheel  263743000 Oct 19 18:12 netbsd.14.core
-rw-------  1 root  wheel    1397481 Oct 19 18:12 netbsd.14
-rw-------  1 root  wheel  969595928 Oct 20 10:59 netbsd.15.core
-rw-------  1 root  wheel    1397481 Oct 20 10:59 netbsd.15
-rw-------  1 root  wheel  947385880 Feb 19 20:21 netbsd.16.core
-rw-------  1 root  wheel    1407645 Feb 19 20:21 netbsd.16
-rw-------  1 root  wheel  949228056 Feb 22 22:39 netbsd.17.core
-rw-------  1 root  wheel    1407645 Feb 22 22:39 netbsd.17
-rw-------  1 root  wheel          3 Feb 26 06:52 bounds
-rw-------  1 root  wheel  917316632 Feb 26 06:53 netbsd.18.core
-rw-------  1 root  wheel    1407645 Feb 26 06:53 netbsd.18
barsoom# crash -M netbsd.9.core -N netbsd.9
Crash version 6.99.22, image version 6.99.22.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x3
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_known() at ipf_frag_known+0x4e
ipf_check() at ipf_check+0xb41
pfil_run_hooks() at pfil_run_hooks+0x9d
ip_input() at ip_input+0x191
ipintr() at ipintr+0x10a
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b37bed70
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.10.core -N netbsd.10
Crash version 6.99.22, image version 6.99.22.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x3
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_known() at ipf_frag_known+0x4e
ipf_check() at ipf_check+0xb41
pfil_run_hooks() at pfil_run_hooks+0x9d
ip_input() at ip_input+0x191
ipintr() at ipintr+0x10a
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b37bed70
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.11.core -N netbsd.11
Crash version 6.99.22, image version 6.99.22.
System panicked: kernel diagnostic assertion "anon != NULL && anon->an_ref != 
0" failed: file "/usr/src/sys/uvm/uvm_amap.c", line 718 
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
?() at ffff80001b8aa810
vpanic() at vpanic+0x13f
_etext() at _etext
amap_wipeout() at amap_wipeout+0xe0
uvm_unmap_detach() at uvm_unmap_detach+0x4c
uvmspace_free() at uvmspace_free+0xec
exit1() at exit1+0x18a
sys_exit() at sys_exit+0x3e
syscall() at syscall+0x94
--- syscall (number 1) ---
7f7ff610b26a:
crash> quit
barsoom# crash -M netbsd.12.core -N netbsd.12
Crash version 6.99.22, image version 6.99.22.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x3
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_known() at ipf_frag_known+0x4e
ipf_check() at ipf_check+0xb41
pfil_run_hooks() at pfil_run_hooks+0x9d
ip_input() at ip_input+0x191
ipintr() at ipintr+0x10a
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b37bed70
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.13.core -N netbsd.13
Crash version 6.99.22, image version 6.99.22.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x7
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
lwp_trylock() at lwp_trylock+0x17
turnstile_block() at turnstile_block+0x2b6
mutex_vector_enter() at mutex_vector_enter+0x223
ipf_derefrule() at ipf_derefrule+0x1c
ipf_frag_delete() at ipf_frag_delete+0x60
ipf_frag_expire() at ipf_frag_expire+0x7e
ipf_slowtimer() at ipf_slowtimer+0x19
ipf_timer_func() at ipf_timer_func+0x2f
callout_softclock() at callout_softclock+0x396
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b3847d70
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.14.core -N netbsd.14
Crash version 6.99.22, image version 6.99.22.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x3
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_known() at ipf_frag_known+0x4e
ipf_check() at ipf_check+0xb41
pfil_run_hooks() at pfil_run_hooks+0x9d
ip_input() at ip_input+0x191
ipintr() at ipintr+0x10a
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b37bed70
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.15.core -N netbsd.15
Crash version 6.99.22, image version 6.99.22.
System panicked: kernel diagnostic assertion "amap->am_anon[lcv]->an_lock == 
srcamap->am_lock" failed: file "/usr/src/sys/uvm/uvm_amap.c", line 889 
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x7
vpanic() at vpanic+0x13f
_etext() at _etext
amap_copy() at amap_copy+0x440
uvm_fault_internal() at uvm_fault_internal+0xfae
trap() at trap+0x4fa
--- trap (number 6) ---
7f7ff710b2bc:
crash> quit
barsoom# crash -M netbsd.16.core -N netbsd.16
Crash version 6.99.24, image version 6.99.24.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x1
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_expire() at ipf_frag_expire+0x7e
ipf_slowtimer() at ipf_slowtimer+0x19
ipf_timer_func() at ipf_timer_func+0x2f
callout_softclock() at callout_softclock+0x396
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b3847d80
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.17.core -N netbsd.17
Crash version 6.99.24, image version 6.99.24.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x1
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_expire() at ipf_frag_expire+0x7e
ipf_slowtimer() at ipf_slowtimer+0x19
ipf_timer_func() at ipf_timer_func+0x2f
callout_softclock() at callout_softclock+0x396
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b3847d80
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# crash -M netbsd.18.core -N netbsd.18
Crash version 6.99.24, image version 6.99.24.
System panicked: trap
Backtrace from time of crash is available.
crash> bt
_KERNEL_OPT_NARCNET() at 0
_KERNEL_OPT_ACPI_SCANPCI() at _KERNEL_OPT_ACPI_SCANPCI+0x3
vpanic() at vpanic+0x13f
printf_nolog() at printf_nolog
startlwp() at startlwp
calltrap() at calltrap+0x19
ipf_frag_known() at ipf_frag_known+0x4e
ipf_check() at ipf_check+0xb41
pfil_run_hooks() at pfil_run_hooks+0xd3
ip_input() at ip_input+0x191
ipintr() at ipintr+0x10a
softint_dispatch() at softint_dispatch+0xd9
DDB lost frame for Xsoftintr+0x4f, trying 0xffff8000b37bdd80
Xsoftintr() at Xsoftintr+0x4f
--- interrupt ---
0:
crash> quit
barsoom# 


-tih
-- 
It doesn't matter how beautiful your theory is, it doesn't matter how smart
you are. If it doesn't agree with experiment, it's wrong.  -Richard Feynman
Follow-Ups:
- Re: Network attack?
  - From: Christos Zoulas
- Re: Network attack?
  - From: Greg Troxel
- Re: Network attack?
  - From: Paul Goyette
References:
- Network attack?
  - From: Paul Goyette
- Re: Network attack?
  - From: Manuel Bouyer
- Re: Network attack?
  - From: Paul Goyette
Prev by Date: Re: Network attack?
Next by Date: Re: Network attack?
Previous by Thread: Re: Network attack?
Next by Thread: Re: Network attack?
Indexes:
Home | Main Index | Thread Index | Old Index