topic Re: Can a port scan cause a panic reboot? in Operating System - HP-UX

Can a port scan cause a panic reboot?

mikestahl — Mon, 15 Mar 2010 15:47:06 GMT

An outside security firm is port scanning our data center servers and the last three syslog messages prior to the panic are below.

Mar 15 09:45:09 incbep2 remshd[4639]: Connection from 10.5.21.182 on illegal port
Mar 15 09:45:09 incbep2 remshd[4641]: Connection from 10.5.21.182 on illegal port
Mar 15 09:45:15 incbep2 remshd[4664]: Connection from 10.5.21.182 on illegal port

# uname -a
HP-UX incbep2 B.11.31 U ia64 0915852207 unlimited-user license

Re: Can a port scan cause a panic reboot?

Patrick Wallek — Mon, 15 Mar 2010 15:50:56 GMT

It would seem unlikely to me, but almost anything is possible.

I would take the crash dump that was generated and have HP analyze it. They should be able to tell for certain what caused the panic.

Re: Can a port scan cause a panic reboot?

Johnson Punniyalingam — Mon, 15 Mar 2010 15:55:41 GMT

>>Can a port scan cause a panic reboot?<<

As mentioned by >>Patrick Wallek ,

start investiagting, btw .?

any valid information show for "panic reboot" under /etc/shutdownlog ..?

Re: Can a port scan cause a panic reboot?

mikestahl — Mon, 15 Mar 2010 16:24:44 GMT

# tail -1 /etc/shutdownlog
10:00 Mon Mar 15 2010. Reboot after panic: Fault when executing in kernel mode

I'm uploading the crash dump for analysis, I was just wondering if anyone has seen this before.

Re: Can a port scan cause a panic reboot?

Tim Nelson — Mon, 15 Mar 2010 18:14:45 GMT

I have seen on Linux but not on HPUX...yet..

but anything is possible.. if the server has not been patched to solve a known issue, then sure, the issue will case an issue ;)

Re: Can a port scan cause a panic reboot?

Patrick Wallek — Mon, 15 Mar 2010 18:57:41 GMT

Doing some searching through HP's knowledge base:

Title: system panic: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000576913-3
Submitted Date: 2007-01-13 12:00:00.0
Last Modified Date: 2009-01-16 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000576913

Title: Panic during cell OL*: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000985417-16
Submitted Date: 2009-11-06 12:00:00.0
Last Modified Date: 2010-03-11 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000985417

Content starts here
Title: panic in perfmon: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000813791-2
Submitted Date: 2008-05-27 12:00:00.0
Last Modified Date: 2008-10-09 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000813791

Search results from TKB:
http://www13.itrc.hp.com/service/james/search.do?mode=text&searchString=Fault+when+executing+in+kernel+mode&submit1=Search+%C2%BB&searchCrit=exactphrase&docTypeAll=yesX&docType=Advisories&docType=SecurityBulletins&docType=EngineerNotes&docType=Drivers&docType=Manuals&docType=Patch&docType=WhitePapers&docType=Forums&dateSearchType=lastXdays&dateRange=all&startDateYear=1999&startDateMonth=0&startDateDay=1&endDateYear=2010&endDateMonth=2&endDateDay=15&resPerPage=20&sortCrit=rank

Re: Can a port scan cause a panic reboot?

Laurent Menase — Mon, 15 Mar 2010 19:15:44 GMT

I see only 2 possibility:
1) Ask support to analyze the crash dump
2) check all hpux security bulletins at
https://www13.itrc.hp.com/service/cki/secBullArchive.do?admit=109447627+1268684038357+28353475

Re: Can a port scan cause a panic reboot?

Laurent Menase — Mon, 15 Mar 2010 19:31:43 GMT

look for Remote Denial of service in the set of Security bulletins.