[Snort-users] Re: Server locks up every 5-6 days

Janko van Roosmalen acs.van.roosmalen at ...1160...
Tue Jan 16 20:12:13 EST 2001


On Mon, 15 Jan 2001, Ron 'The InSaNe One' Rosson wrote:

> I have a server running at a clients that has a problem of rebooting
> every 5-6 days. It duties are as follows:
> 
> 	Provide NAT for 25 workstations
> 	Be a Network Firewall
> 	Be a Network IDS
> 	Run a Web server for easy viewing for the Higher-ups
> 
> The Server is FreeBSD 4.2-STABLE as of Dec 21, 2000 running on a k6-2
> 400 (mobo has the pcib2: <VIA 82C598MVP (Apollo MVP3) Chipset>. The
> internal and externla interfaces are Intel Pro 10/100B/100+ Ethernet
> cards. Machine has 64megs of RAM
> 
> The NAT and Firewall chores are being handled by ipfilter 3.4.8
> 
> The IDS is snort version 1.7 logging to a mysql database (localhost)
> running the vision.conf ruleset (http://whitehats.com/ids)
> 
> The webserver is Apach version 1.3.14 with mod_php4 (to allow ACID for
> snort to be viewed proplerly).
> 
> The only public port open to this box is 22 (ssh) for administrative
> purposes. All other ports are blocked or filtered.
> 
> >From looking at the /var/log/messages and the ACID interface the box
> seems to get bombarded with the following log entires:
> 
> Jan 11 18:26:30 mybox snort: IDS193/ddos-stacheldraht server-spoof: xxx.xxx.xxx.xxx -> xxx.xxx.xxx.xxx
> 

Stacheldraht (German for barbed wire) is a tool used for distributed DOS
attacks. Either you are a target or used as a launchpad for Stacheldraht
DOS attacks. This type of attack brought down yahoo and amazon last year. 

You can find information about Stacheldraht on www.cert.org. You also
could report this incident to CERT at www.cert.org. 

> 
> Anyone have any ideas what could be causing this.. The Lockups are in
> such a way that the only choice you have is to hit the reset button.
> 

===Janko van Roosmalen - Vught - Netherlands===





More information about the Snort-users mailing list