From: Carlos Sevillano (carlos_sevillano@ureach.com)
Date: Mon Aug 25 2003 - 12:29:24 EDT
Solaris 2.6
Solaris 8
RICHPse
I am getting these error messages in five minute cycles on two
of my systems:
TCP PROTOCOL INFORMATION
red Incoming connections refused: port scanner (Satan?) a
attack
TCP PROTOCOL INFORMATION
amber Incoming connection refused: invalid port, RST sent
Snoop shows that most of the traffic is between the Solaris 2.6
and Solaris 8 systems. Both systems are showing the same errors
on RICHPse.
The systems are configured such that System-A (solaris 2.6) has
hme0, hme0:1 and hme0:2. This machine is an Oracle and MQ
Machine.
The other system, System-B (solaris 8) has hme0 and hem0:1.
This machine is web-logic, web-servers, ldap and uses the 2.6
machines for all database queries.
When I get these conditions on either machine... application
users get slow-downs that are impacting users. Any ideas as to
what can be the cause of this? I am attaching the errors form
the 2.8 machine. The 2.6 machine has the same errors and
similar stats. I don't see any packets been dropped... just
Stack Errors:
TCP PROTOCOL INFORMATION
The current TCP state is:
amber Incoming connection refused: invalid port, RST sent
TCP measures Rate/s
Input bytes 200146.42
Output bytes 88553.30
Input segments 393.46
Output segments 286.27
Retrans bytes 282.89
Retrans percent 0.32
Duplicate bytes 8.52
Duplicate percent 0.00
Active Opens (connects) 0.13
Attempt Fails 0.07
Passive Opens (accepts) 1.86
RSTs generated 1.06
Listen Drops 0.00
Listen Drops (from Q0) 0.00
Half Open Drops 0.00
TCP PROTOCOL INFORMATION
The current TCP state is:
red Incoming connections refused: port scanner (Satan?) attack
TCP measures Rate/s
Input bytes 195256.04
Output bytes 115260.54
Input segments 367.68
Output segments 291.54
Retrans bytes 99.29
Retrans percent 0.09
Duplicate bytes 1.09
Duplicate percent 0.00
Active Opens (connects) 0.23
Attempt Fails 0.07
Passive Opens (accepts) 2.95
RSTs generated 2.59
Listen Drops 0.00
Listen Drops (from Q0) 0.00
Half Open Drops 0.00
Carlos
________________________________________________
Get your own "800" number
Voicemail, fax, email, and a lot more
http://www.ureach.com/reg/tag
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:26:59 EDT