topic Re: Telnet Busy in Operating System - HP-UX

Telnet Busy

John Walker — Fri, 29 Jun 2001 19:59:43 GMT

Can anyone suggest a reason why suddenly on several of our servers, users are being repeatedly disconnected. Corresponding messages in the syslog for the related port are "Telnet busy, connection refused"?

Re: Telnet Busy

A. Clay Stephenson — Fri, 29 Jun 2001 20:23:18 GMT

Hi John,

I'm certainly guessing but I can't believe that you are having an npty ot nstrpty problem on several servers at once. My best guess is that you are under a denial of service attack.

Re: Telnet Busy

A. Clay Stephenson — Fri, 29 Jun 2001 21:04:23 GMT

Okay John,

Guess Number Two (and I am delighted to be wrong on Guess No. 1): Is anyone doing a security audit on your system and thus hammering port 23? I'm having a very difficult time coming up with a common failure mode on multiple servers. I assume you have not installed new software/patches. Are all of the problems occuring on the same subnet? I'm just looking for clues.

Clay

Re: Telnet Busy

Saurabh Kapoor — Fri, 29 Jun 2001 21:12:13 GMT

Hi,
Can you try to run a netstat command for port 23.
To do that do as folllows:
X.25 Trace
=========

Go to the root directory:
# cd /
# nettl -stop #Stop previous trace
# rm /var/adm/trace.x25.TRC0 #Removes previous trace
# nettl -start #Start Trace

> Following line filters the trace and store only the interesting X.25 part in the file /var/adm/trace.x25.TRC0 (.TRC0 appends automatically).
# nettl -tn 0xff000000 -e SX25L2 SX25L3 -c x25_0 -f /var/adm/trace.x25
# netfmt -F -f /usr/adm/trace.x25.TRC0 #Format and echo the trace.

X25 trace.12

# nettl -stop
# rm /usr/adm/trace.x25.TRC0
# nettl -start
# nettl -tn 0xff000000 -e SX25L2 -c x25_0 -f /usr/adm/trace.x25
# netfmt -F -f /usr/adm/trace.x25.TRC0
# nettl -stop

X25 trace.13
# nettl -stop
# rm /usr/adm/trace.x25.TRC0
# nettl -start
# nettl -tn 0xff000000 -e SX25L3 -c x25_0 -f /usr/adm/trace.x25.TRC0
# netfmt -F -f /usr/adm/trace.x25.TRC0
# nettl -stop