topic rpcbind - file descriptors in Operating System - HP-UX

rpcbind - file descriptors

Malcolm McKenzie — Fri, 18 Jan 2002 09:14:21 GMT

I have a problem with the rpcbind process, it is collecting open file descriptors but not letting them go (I am monitoring using lsof). As it reaches it's limit we get the message "rpcbind - too many open files" in our syslog. Example line of output from lsof below:

rpcbind 26977 root 17u inet 72,0x72 0t0 TCP 67.250.61.40:* (BOUND)

If anyone has any ideas what could cause this I'd like to know.

Re: rpcbind - file descriptors

Steven Sim Kok Leong — Fri, 18 Jan 2002 09:22:27 GMT

Hi,

From the security perspective, is someone trying to launch a denial of service attack on you across the network?

If you never had such encounters in the past, check the IP addresses that are connecting to your server. Are they legitimate?

Hope this helps. Regards.

Steven Sim Kok Leong

Re: rpcbind - file descriptors

Mark Greene_1 — Fri, 18 Jan 2002 09:29:44 GMT

run rpcinfo and see what/how many IP addresses are listed. Also, are you exporting alot of filesystems over NFS?

--
mark

Re: rpcbind - file descriptors

Malcolm McKenzie — Tue, 29 Jan 2002 07:42:37 GMT

The ip addresses do not seem to be recognisable and the addresses from rpcinfo do not match. All the open files have end in .40. Any more ideas?

Re: rpcbind - file descriptors

Steven Sim Kok Leong — Tue, 29 Jan 2002 09:11:59 GMT

Hi,

Block this IP address out from your network-based firewall and check if this solves your problem.

Hope this helps. Regards.

Steven Sim Kok Leong

Re: rpcbind - file descriptors

Malcolm McKenzie — Tue, 29 Jan 2002 09:18:08 GMT

Thanks but the ip address mentioned is only an example. Here are ten more:

rpcbind 19754 root 101u inet 72,0x72 0t0 TCP 73.124.89.40:* (BOUND)
rpcbind 19754 root 102u inet 72,0x72 0t0 TCP 67.35.5.40:* (BOUND)
rpcbind 19754 root 103u inet 72,0x72 0t0 TCP 81.80.77.40:* (BOUND)
rpcbind 19754 root 104u inet 72,0x72 0t0 TCP 75.0.9.40:* (BOUND)
rpcbind 19754 root 105u inet 72,0x72 0t0 TCP 67.36.1.40:* (BOUND)
rpcbind 19754 root 106u inet 72,0x72 0t0 TCP 79.4.49.40:* (BOUND)
rpcbind 19754 root 107u inet 72,0x72 0t0 TCP 71.204.193.40:* (BOUND)
rpcbind 19754 root 108u inet 72,0x72 0t0 TCP 73.56.65.40:* (BOUND)
rpcbind 19754 root 109u inet 72,0x72 0t0 TCP 73.32.137.40:* (BOUND)
rpcbind 19754 root 110u inet 72,0x72 0t0 TCP 72.156.133.40:* (BOUND)

The only thing in commons is the .40?

Re: rpcbind - file descriptors

Malcolm McKenzie — Tue, 29 Jan 2002 14:15:17 GMT

I was using an lsof binary not matched to my kernel. I recompiled lsof and the output from lsof now makes sense, the problem is with a firewall - thanks for the responses.