Re: Limiting closed port RST response from 381 to 200 p

From: admin (admin@crimelords.org)
Date: 04/16/02 

Date: Tue, 16 Apr 2002 11:22:29 -0500 (CDT)
From: admin <admin@crimelords.org>
To: Mike Silbersack <silby@silby.com>

On Mon, 15 Apr 2002, Mike Silbersack wrote:

>
> On Tue, 16 Apr 2002, Andrew Johns wrote:
>
> > Actually Sheldon I think that's a great idea - helps with
> > syslog DoS somewhat as well. Anybody else care to contemplate
> > making it either a default or sysctl (ICMP_BANDLIMIT_DOSLIMIT?)
> >
> > AJ
>
> As the messages are limited to once per second, it's not really a syslog
> DoS. Just an annoyance, as Sheldon mentions. I think that seeing the
> rate is useful, although having a sysctl which allows one to switch over
> to the format Sheldon uses could be useful. I have considered MFCing the
> sysctl which disables the display of these messages and making off the
> default, given that many people seem to panic when seeing "limiting blah".
>
> As the rate of incoming packets seems pretty steady, I'd wager that
> Christoph is being scanned by nmap or some similar tool. A true DoS would
> probably involve a much higher packet rate.
>
> Mike "Silby" Silbersack

Higher rate like what I see on a few of my irc shell servers:
Limiting icmp unreach response from 5263 to 200 packets per second
Limiting icmp unreach response from 5202 to 200 packets per second
Limiting icmp unreach response from 5233 to 200 packets per second
Limiting icmp unreach response from 5216 to 200 packets per second
Limiting icmp unreach response from 5228 to 200 packets per second

This fills dmesg and messages constantly and the coelescing is a God-send
when you have a few hours of DoS. I agree with having a sysctl to switch
so that I can decide myself and also diferentiate btwn scans and attacks

-emac

>
>
> To Unsubscribe: send mail to majordomo@FreeBSD.org
> with "unsubscribe freebsd-security" in the body of the message
>

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • speed issues
    ... When downloading or uploading files from this freebsd using ftp a have ... Limiting icmp unreach response from 268 to 200 packets per second ...
    (freebsd-questions)
  • speed issues
    ... When downloading or uploading files from this freebsd using ftp a have ... Limiting icmp unreach response from 268 to 200 packets per second ...
    (freebsd-questions)
  • Re: Limiting closed port RST response from 381 to 200 p
    ... Snort is monitor the packets when find DoS detected and it send ... to syslog so the guardian find snort's alert on syslog and it will ... That's how i recieved lot DoS pretty often. ... > Limiting icmp unreach response from 5263 to 200 packets per second ...
    (FreeBSD-Security)