topic Re: v11.11 DOS Attack in Operating System - HP-UX

v11.11 DOS Attack

Tom Dawson — Tue, 05 Feb 2002 17:23:57 GMT

It seems I am generating my own little DOS attack, against myself!

I have just installed v11.11 on a D330. I configured the onboard 10 Mbps NIC during the installation. When the server boots into HP-UX v11.11, it appears that the D330 is flooding my network with packets. None of the other servers can ping each other and all connectivity seems to stop. As soon as I pull the patch cable from the 10 Mbps NIC on the D330, traffic starts flowing again bwtween the other servers. The D330 can ping out to other servers, but other servers can't get to the D330.

I know the NIC itself is okay because I can boot the D330 to the old v10.20 on the alternate disks and there is no problem.

Have I missed something simple? Has anyone seen something like this before?

TIA!
Tom

Re: v11.11 DOS Attack

Paula J Frazer-Campbell — Tue, 05 Feb 2002 17:39:23 GMT

Hi
Check the ip address - is it a duplicate?

Paula

Re: v11.11 DOS Attack

Tom Dawson — Tue, 05 Feb 2002 17:45:13 GMT

Paula,

Thanks, but no, it is not a duplicate. I'm using the same IP address used in the 10.20 install.

Thanks,
Tom

Re: v11.11 DOS Attack

Victor BERRIDGE — Tue, 05 Feb 2002 17:56:53 GMT

Hi,
Last time I saw something of the sort was when a lancard 10Mb was configured full duplex (!!!)
Dont laugh it was the default option on an IBM SP install...
Are you sure of your netmask AND gateway?

All the best

Victor

Re: v11.11 DOS Attack

Paula J Frazer-Campbell — Tue, 05 Feb 2002 18:00:32 GMT

Tom

Inverse logic could it be your network trying to find out about the server?

ALSO

Check out the differences in hosts, netconf, nfs, etc from 10 to 11.

What other changes on the NIC card from 10 to 11.

Also check the mac address are you moving from a forced mac address on 10.20.

HTH

Paula

Re: v11.11 DOS Attack

Tom Dawson — Tue, 05 Feb 2002 18:27:21 GMT

Victor,

I had seen some discussions here in the forum about lan cards being configured half/full duplex. I looked in SAM and could not determine how the onboad NIC is configured. Would you happen to know how I can determine that?

Thanks!

Paula,

I've copied the HP supplied nsswitch.files to nsswitch.conf so that I am only trying to resolve with local files. The MAC addresses have not changed and they are the factory set values.

Thanks,
Tom

Re: v11.11 DOS Attack

S.K. Chan — Tue, 05 Feb 2002 18:37:34 GMT

You can use lanadmin command. Example ..

# lanadmin
..
Enter command : lan
..
Enter command : display
...

Re: v11.11 DOS Attack

Nobody's Hero — Tue, 05 Feb 2002 18:56:42 GMT

Speaking of which,
Can someone tell me how to change the duplex speed from the command line?

Re: v11.11 DOS Attack

Kevin Wright — Tue, 05 Feb 2002 19:21:50 GMT

lanadmin -S

Re: v11.11 DOS Attack

Bill Hassell — Wed, 06 Feb 2002 02:10:58 GMT

Use lanadmin to determine the current speed and duplex: lanadmin -x

And check the LAN statistics by running lanadmin interactively and displaying the error information. ppa is the LAN card ID which can be found from lanscan.