Telnet Busy

[John Walker]

Can anyone suggest a reason why suddenly on several of our servers, users are being repeatedly disconnected. Corresponding messages in the syslog for the related port are "Telnet busy, connection refused"?

[A. Clay Stephenson]

Hi John,

I'm certainly guessing but I can't believe that you are having an npty ot nstrpty problem on several servers at once. My best guess is that you are under a denial of service attack.

[A. Clay Stephenson]

Okay John,

Guess Number Two (and I am delighted to be wrong on Guess No. 1): Is anyone doing a security audit on your system and thus hammering port 23? I'm having a very difficult time coming up with a common failure mode on multiple servers. I assume you have not installed new software/patches. Are all of the problems occuring on the same subnet? I'm just looking for clues.

Clay

[Saurabh Kapoor]

Hi,
Can you try to run a netstat command for port 23.
To do that do as folllows:
X.25 Trace
=========

Go to the root directory:
# cd /
# nettl -stop #Stop previous trace
# rm /var/adm/trace.x25.TRC0 #Removes previous trace
# nettl -start #Start Trace

> Following line filters the trace and store only the interesting X.25 part in the file /var/adm/trace.x25.TRC0 (.TRC0 appends automatically).
# nettl -tn 0xff000000 -e SX25L2 SX25L3 -c x25_0 -f /var/adm/trace.x25
# netfmt -F -f /usr/adm/trace.x25.TRC0 #Format and echo the trace.

X25 trace.12

# nettl -stop
# rm /usr/adm/trace.x25.TRC0
# nettl -start
# nettl -tn 0xff000000 -e SX25L2 -c x25_0 -f /usr/adm/trace.x25
# netfmt -F -f /usr/adm/trace.x25.TRC0
# nettl -stop

X25 trace.13
# nettl -stop
# rm /usr/adm/trace.x25.TRC0
# nettl -start
# nettl -tn 0xff000000 -e SX25L3 -c x25_0 -f /usr/adm/trace.x25.TRC0
# netfmt -F -f /usr/adm/trace.x25.TRC0
# nettl -stop