I've got the latest grsec stable, but i'm having a problem with getting ip_conntrack working.
I did the following with make menuconfig after copying my default kernels config file...
Networking -> Networking support -> Networking options -> Network packet filtering framework (Netfilter) -> Core Netfilter -> Configuration -> Netfilter Xtables support (required for ip_tables) -> "conntrack" connection tracking match support.
After a compile and reboot:
error: "net.ipv4.netfilter.ip_conntrack_generic_timeout" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_icmp_timeout" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_close" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_time_wait" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_last_ack" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_close_wait" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_fin_wait" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_established" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_sent" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_udp_timeout" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_udp_timeout_stream" is an unknown key error: "net.ipv4.netfilter.ip_conntrack_max" is an unknown key error: "net.ipv4.ip_conntrack_max" is an unknown key
I did a ls on /lib/modules/2.6.27.10-grsec/kernel/net/ipv4/netfilter and dont see the modules that i see in the default kernels...
Is it normal for a ton of packets to be dropped? My server goes so slow after it gets a bunch of connections, even if I kill everything (i have to restart), and I can't figure out what the problem is. on my other servers it says no packets were dropped. how can i fix this?
I just wanted to check with you all to see if you have experienced an issue with cpanel that drops the www when you access directories and if so, how did you go about fixing it.
For example - if I were to go to - www.domain.com and then access a sub like /test - it would show up as domain.com/test - dropping the www.
I have been getting ddossed for the last month, my host has tried many things on my server that are commonly suggested around here, however we have over 40 000 connections hitting the server from this attack and it keeps rising.
I am on LiteSpeed. I also have NetScreen 50 firewall which helped for a little while, however the server still keeps going down.
I am spending $420 a month on my hosting for my dedicated server Now it is costing me an extra $400 a month to have Netscreen firewall running which is a waste of money as it can not effectively keep the server running and i'm not sure if I can even effectively afford that much money a month, however I might need to spend a little more if need to just get the server running finally.
basically I need some options as to what I can do. I would like to stay with my host, they have been good to me, however if my options are better suited to changing then let me know. I just really need to get my server running great asap and to keep it running great when i'm away from the internet.
after putting up a very simple email program and having it email me a set of text, it looks like it is not a software problem, but something to do with the IIS email server. Has any one ran into this?
I own my domain [url] and have a reseller plan on a shared host [url]I have the DNS on godaddy pointed to the nameservers of reyox and on the Cpanel of my domain at reyox I have a forwarding account [url]set to forward to my gmail account.
To the best of my knowledge this has worked flawlessly for years but recently I have been starting to not receive emails from people. I found out when I wasn't getting replies I had been expecting and when I inquired or called the people instead they told me that hey replied... it's been happening over and over again lately.
When I asked my host last week they replied: "We did clear up some mail issues last night, some issues with the queue processing."
However after that it kept happening and now I am at a loss.
I don't know what's wrong nor how to troubleshoot it... It happened with people that are on all sorts of domains (gmail, aol, personal domains etc) and it happens sporadically... It's really frustrating because I don't know what else I am not getting considering that every other day I find out about an expected email I didn't get.
The werid thing is that none of the senders whose emails got lost reported that they received a bounce issue...
how I can address this in terms of troubleshooting it and finding a solution?
Is there some sort of email monitoring services like there are site uptime monitoring services?
Quick scenario, I run a few public game servers, and we have had a member go insane.
This member has been using a piece of software, to do a simple DDoS attack, and when they perform this attack, it laggs everybody out, and takes down the individual game server.
While this is occurring, I have been watching with a network analyzer program, and noticed the packets go sky high (from 4.4k to 150k+).
So, I am in need of a quick, piece of software that can block flood attacks, or whatever is going on.
I have a dedicated windows 2003 server at a colocation facility that i use for game server hosting. Over the past 7 months, packet loss has become horrible with random periods of massive lag. My host says it's something on my end. I use a firewall with SPI enabled. Could that be causing it?
Strange thing is, the first few months my server was at that colo, they only had around 40 other servers on a single OC-192 pipe and i never had packet loss despite having the same SPI firewall. But now they have over 300 servers on the same OC-192 pipe. Could the packet loss be caused by my SPI firewall or them overloading the network with servers?
Basically I registered with a new host. They sent me the details with obviously includes the IP address. I tested the IP address on just-ping.com and it came back with all of them having between 80% to 100% packet loss. Surely this is not normal is it? I havent moved my domain yet but it doesnt look good does it? Should I cancel?
ERROR 1153 (08S01) at line 2663: Got a packet bigger than 'max_allowed_packet' bytes
why I got this error and how to fix this? vbulletin staff told me that I have to increase the 'max_allowed_packet' in my.cnf, then restart MySQL. Where can I find this file? I use Directadmin control panel for my dedicate server.
Computer A (GigE) Switch 1 (gigE) Media Converter (Fiber Run) Media Converter (gigE) Switch 2 (gigE) Computer B
We have a cross connect in our data center that uses media converters (fiber) to regular 1000FD on each end.
Each end of the 1000FD handoff is plugged into port 1 of the 3870's (switch 1 and switch 2).
Pinging from Computer A to Computer B we receive a 50% packet loss. Pinging from Computer B to Switch 1, no packet loss. Pinging from Computer A to Switch 2, 50% packet loss.
Looking in the interface, the port 1's on each switch auto negotiate to 1000FD, however flow control shows as off.
We asked our data center to run tests on the media converts and fiber runs and everything comes back 100% fine. Has anyone seen a weird issue like this before with 3com switches not playing nicely with media converters?
I have no clue whats going on and our data center said the fiber run/media converter is fine... [url]
I having having issue with few of my servers sending Reset packet to a particular IP. I have disabled my firewall and noticed that few machines (Unix/Windows) is still sending Reset package to one IP only. Reset packet will be sent over on all ports except icmp ping.
Anybody know where to check? Or the server on the other IP is having problem which cause my servers to send the Reset packet
I have smokeping monitoring my game servers and so far in the little time that it has been running all my game servers have been encountering an average of 4 to 10% packet loss. Are there are tweaks i can run on the server computer to reduce packet loss? (registry modifications, etc.)
I downloaded a TCP tweak program called "TCP Optimizer" is it safe to run on a Windows 2003 Server OS?
The colo connection is an OC 192 and i have a 100Mbit ethernet card.
How do packet losses affect running of a website, say i get packet loss for some site like around 30-40% but can still browse their websites, so how do packet losses affect working of a website ?
Recently I have been having this problem with two high traffic servers on two different network.
Both servers are Quad-Core Xeons with CentOS 4.5 x86_64 and they are on 100mbps full duplex network. Software configuration is Nginx+Apache+MYSQL control panel is Directadmin.
The servers are serving lots static files and some php scripts.
When the servers start push near or over 30mbps, there will be packet loss when I ping them. around 5% loss, push more bandwidth the more packet loss. I have checked all the log files, I don't see any unusual errors.
Server Load is fine. The NICs were on 100mbps full-duplex mode.
The datacenters claim the networks were fine and all the other servers running on the same switches were fine with no packet loss.
I'm trying to find out why a single interface is causing packet loss on my entire network.
The network consists of four 2924's trunked to a 3550. I have about 20 vlans and a single default route for all traffic my uplink.
The network is perfect until I enable a single server. After I issue a 'no shut' on the interface packet loss is anywhere from 5% to 20% for anything going through the 3550 or even pings from the 3550 to other switches or the uplink.
Here's the statistics/settings of the interface after 1 minute of activity:
Our network have been ddosed very heavily for the last 15 days.
These attacks are relatively small 50 - 100 mbits at most but in very very high PPS rate.My firewall counts 10Billion packets in a single hour of an attack period. We are dealing with these attacks with a combination of freebsd pf transparent bridge firewalls and mostly null routing.
I were able to capture some packets from different attacks from last week and today.
After deeply checking these attack capture files I can see that our attack comes from several thousands different spoofed Ip addresses but always the same mac address in their packet headers.So I thought if this attack is coming to us from a single machine rather than hundreds of different zombie servers.
I don't have a clue how to trace back this attack and find the real ip address behind. My upstream provider also don't have enough knowledge to help me.
So after todays attack I thought about sharing my capture files during attack and hope that someone here will help me. And show me a way to trace back these attacks.
a tool that can measure how much packet loss we are having on a given server by looking at the packets being sent from it. I.e, something than looks at all TCP/80 connections and measures how many packets and bytes are being retransmitted vs actual packets and bytes sent.
This documents explains it:
[url]
We need this to measure network performance of different hosts where we have dedicated servers. This would be a good way of measuring performance with the actual data of our users.
Does anyone know of such tool? I.e, something that can say
2532 packets/second - 132 retransmits/second (4.8%) 25.43Mbps/sec total traffic - 24.84 Mbps/sec actual data sent - 0.59Mbps retransmits
Even better if it can then break it out on IP prefixes. like
I recently switched over to SoftLayer for dedicated hosting and the servers are great. However we've been getting hit on and off with massive (50-80%) packet loss, which has been crippling our performance and causing all sorts of problems
I put in a support ticket and they linked me to the Internet Health Report website and said it was due to one of their bandwidth providers (I think Global CrossinG) and not on their internal network and to be patient as it could take time to resolve
Are any other SoftLayer customers going through this? Is this an unusual occurrence? I feel like if it was really one of their partners that it would be affecting a lot of their customers and it would be a high priority issue right?
I'm kind of stuck on what to do; I just invested a lot of energy into moving content onto these new servers and am concerned about whether to wait it out or whether to start finding a new company. This kind of packet loss is really unacceptable...
