denial of service attack possible

[Mark () MISTY COM (Mark Thomas)]

Hi,

I posted this to sun-managers, but it has some nasty consequences if deliberately
exploited.  If anyone has any more info, or ideas for a fix, please let me know.

Subject: denial of service problem on port 80 with 4.1.4
To: sun-managers () ra mcs anl gov
Date: Fri, 27 Oct 1995 00:59:49 -0400 (EDT)

I run a web server on a 110 MHz SPARC-5 clone running 4.1.4 with the below kernel
and libc patches, and a second sbus FSBE SCSI and buffered ethernet card:

102264-02,102394-01,102422-01,102426-03,102430-01,102433-01,102516-02,102517-01,10
2536-01,102545-02

Last night, the machine completely stopped accepting connections on port 80 to the
web server.

netstat -an indicated:
Active Internet connections (including servers)
Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)
tcp        0      0  205.164.146.26.80      146.94.1.2.2972        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2763        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2762        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2612        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2611        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2610        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2609        SYN_RCVD
tcp        0      0  205.164.146.26.80      146.94.1.2.2541        SYN_RCVD
tcp        0      0  *.80                   *.*                    LISTEN

These connections persisted over an hour, and finally I had to block the
specific remote machine with a filter rule in the router, at which point
the web server picked up with it's usual incoming connection activity.
(greater than 10,000 web connections per hour)

The explanation from the remote site was that they were running tia
(The Internet Adapter), and that it was causing these problems, and
they were working with the makers of the software to fix it.

It concerns me that one remote site can so easily completely block all
incoming tcp/ip connections on a port.  Is this a kernel bug, or something
I can take some measure to prevent on this end?

I know it is not a httpd program related problem, because the problem persisted
even when I tried running a completely differently designed web server program
on that port.  I am also wondering if this particular bug or problem might
account for other periodic times when my machine takes a long time to accept
incoming connections.

If anyone has any more specifics on this problem, please let me know.  When
the server is healthy netstat indicates a couple SYN_RCVD state services, but
they never last from one netstat command to another for the same remote IP.

-Mark



--
Mark G. Thomas (Mark () Misty com)