[Snort-users] Server locks up every 5-6 days
swun at ...957...
Mon Jan 15 22:37:33 EST 2001
Can you show your df result?
Ron 'The InSaNe One' Rosson wrote:
> I have a server running at a clients that has a problem of rebooting
> every 5-6 days. It duties are as follows:
> Provide NAT for 25 workstations
> Be a Network Firewall
> Be a Network IDS
> Run a Web server for easy viewing for the Higher-ups
> The Server is FreeBSD 4.2-STABLE as of Dec 21, 2000 running on a k6-2
> 400 (mobo has the pcib2: <VIA 82C598MVP (Apollo MVP3) Chipset>. The
> internal and externla interfaces are Intel Pro 10/100B/100+ Ethernet
> cards. Machine has 64megs of RAM
> The NAT and Firewall chores are being handled by ipfilter 3.4.8
> The IDS is snort version 1.7 logging to a mysql database (localhost)
> running the vision.conf ruleset (http://whitehats.com/ids)
> The webserver is Apach version 1.3.14 with mod_php4 (to allow ACID for
> snort to be viewed proplerly).
> The only public port open to this box is 22 (ssh) for administrative
> purposes. All other ports are blocked or filtered.
> >From looking at the /var/log/messages and the ACID interface the box
> seems to get bombarded with the following log entires:
> Jan 11 18:26:30 mybox snort: IDS193/ddos-stacheldraht server-spoof: xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx
> Anyone have any ideas what could be causing this.. The Lockups are in
> such a way that the only choice you have is to hit the reset button.
More information about the Snort-users