[ale] Em

[jj at spiderentertainment.com]

I would definitly think that this is the case, is there something I can verify
this with ?
Is there a patch ?

Joe Steele wrote:

> The kernel was trying to access memory which resulted in a paging request
> for an invalid page.  When a user program performs such an action, the
> program is terminated with a signal 11 (Invalid memory reference).  When
> the kernel performs such an action, it results in the oops message which
> you found.
>
> "tcp_conn_request_fake" is a routine in the networking code involved in the
> defense against SYN flood attacks by using SYN cookies.  The kernel was
>  executing this part of the code at the time of the error.  The messages
> say you were subjected to a SYN flood attack.  Such an attack is normally
> intended to cause denial of service for network users trying to access the
> host.
>
> Maybe somebody is exploiting a bug which causes the oops?
>
> --Joe
>
> -----Original Message-----
> From:   jj at spiderentertainment.com [SMTP:jj at spiderentertainment.com]
> Sent:   Friday, October 08, 1999 3:48 PM
> To:     ale at ale.org
> Subject:        [ale] Em
>
> Ok I sent earlier message in regards to kernel message, now I really
> need some help.
>
> My system info
>
> Dual PII Xion 512 MB
> MegaRaid, Raid-5(hardware)
>
> RH5.2 Kernel 2.0.36 SMP is NOT enabled.
>
> message from /var/messages
> Oct  8 15:42:54 spiderone kernel: Unable to handle kernel paging request
> at virtual address 401f4000
> Oct  8 15:42:54 spiderone kernel: current->tss.cr3 = 0b2fe000, `r3 =
> 0b2fe000
> Oct  8 15:42:54 spiderone kernel: *pde = 17bb8067
> Oct  8 15:42:54 spiderone kernel: *pte = 00000000
> Oct  8 15:42:54 spiderone kernel: Oops: 0000
>
> ...
>
> Oct  8 15:42:54 spiderone kernel: Call Trace:
> [tcp_conn_request_fake+210/1284] [tcp_conn_request_fake+465/1284]
>  [ip_fw_chk+1585/1948] [block_read+574/1464] [block_read+1030/1464]
> [elf_core_dump+2196/2616] [load_aout_binary
> +263/1520]
> Oct  8 15:42:54 spiderone kernel:        [sys_swapoff+33/736]
> [block_read+1435/1464] [get_cpuinfo+173/752]
>
> ...
>
> Warning: possible SYN flood from 62.252.5.66 on 209.146.154.68:80.
> Sending cookies.