..on Mon, Jan 23, 2006 at 06:40:10PM +0100, Bernd Eckenfels wrote:
> Julian Oliver <julian@xxxxxxxxxxxxxxx> wrote:
> > taking down eth1 resulted in ksoftirqd immediately dropping to a sub-percent CPU load and my screaming fan ceasing to scream.
> > everything returns to normal.
>
> can you show use multiple "netstat -i" and "cat /proc/interrupt" and
> "netstat -s" and "cat /proc/net/stat/*" snaphsots. To me it sounds like you
> have been DDOSed.
i will do this next time given i can use the terminal for long enough.
admittedly i don't yet know how to read the contents of "cat
/proc/net/stat/*"
there was nothing conspicuous under netstat -s/-i when checked before taking
the machine down last time.
is there any diagnosis after a reboot that might reveal what happened?
i feel a DDoS is a bit unlikely though, as i'm on a fairly well locked down internal
network with one other machine. also after a fast reboot last time, the
problem went away immediately, yet i could send the system into the same
state before a reboot just by bringing the nic back up, and even when i wasn't on the local network.
would a DDoS really annoy ksoftirqd that much? i'm ignorant as to how a DDoS would look from the process table's
perspective.
julian
--
_ _ _
___ ___| |___ __| |_ _ __ __ _ _ _| |__ ___
(_-</ -_) / -_) _| _| '_ \/ _` | '_| / /(_-<
/__/\___|_\___\__|\__| .__/\__,_|_| |_\_\/__/
|_http://selectparks.net/~julian
-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
