From: "Barry Irwin" <[EMAIL PROTECTED]>
: Just wondering if anyone else has experiance the following problem:
Yup. FreeBSD 4.3.
: I have a number of networks running with FreeBSD firewalls providing a
: nat service to a number of hosts behind the wall itself. Both outgoing
nat,
: and port_redirection is provided. THis has been running stabily for over
a
: year. However in the last 10 days I have had a number of these natd
: mprocesses suddenly bloat ( looking at 48Megs upwards when they normally
sit
: at around 700K-1Meg. Ping times to the firewalls ( infact any packets
: passing through the natd process are delayed, it seems to suffer a type of
: exponential decay, with the highest delay I have recorded being in the
order
: of 240 seconds!
Same kind of things. CPU loss, network congestion.
: This has sofar impacted 4.0-Release, 4.1-RELEASE as well as 4.3-STABLE.
: Reviews of tcpdumps collected once slowdown has been noticed do not show
any
: signs of strange activity. What I am wondering is , is there some new
: Scanning /DoS tool, which is causing natd to get its data structures in a
: knot, and thereby grow massively, in addition to the slowdown.
CodeRed, in my case.
One machine (Win2000, IIS) had port 80 redirected to 'the world', got caught
by this worm, infected other machines. Natd took 99% CPU time, pings were
dramatically long.
Cleaning infected machines (only 9 of them) helped. Now natd takes 0.1% CPU,
pings are < 1 ms. As it should be :)
Hope it helps.
--
Konrad
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message
