Operating System - HP-UX
1748060 Members
5942 Online
108758 Solutions
New Discussion юеВ

Re: Can a port scan cause a panic reboot?

 
mikestahl
New Member

Can a port scan cause a panic reboot?

An outside security firm is port scanning our data center servers and the last three syslog messages prior to the panic are below.

Mar 15 09:45:09 incbep2 remshd[4639]: Connection from 10.5.21.182 on illegal port
Mar 15 09:45:09 incbep2 remshd[4641]: Connection from 10.5.21.182 on illegal port
Mar 15 09:45:15 incbep2 remshd[4664]: Connection from 10.5.21.182 on illegal port

# uname -a
HP-UX incbep2 B.11.31 U ia64 0915852207 unlimited-user license
7 REPLIES 7
Patrick Wallek
Honored Contributor

Re: Can a port scan cause a panic reboot?

It would seem unlikely to me, but almost anything is possible.

I would take the crash dump that was generated and have HP analyze it. They should be able to tell for certain what caused the panic.
Johnson Punniyalingam
Honored Contributor

Re: Can a port scan cause a panic reboot?

>>Can a port scan cause a panic reboot?<<

As mentioned by >>Patrick Wallek ,

start investiagting, btw .?

any valid information show for "panic reboot" under /etc/shutdownlog ..?
Problems are common to all, but attitude makes the difference
mikestahl
New Member

Re: Can a port scan cause a panic reboot?

# tail -1 /etc/shutdownlog
10:00 Mon Mar 15 2010. Reboot after panic: Fault when executing in kernel mode

I'm uploading the crash dump for analysis, I was just wondering if anyone has seen this before.
Tim Nelson
Honored Contributor

Re: Can a port scan cause a panic reboot?

I have seen on Linux but not on HPUX...yet..

but anything is possible.. if the server has not been patched to solve a known issue, then sure, the issue will case an issue ;)

Patrick Wallek
Honored Contributor

Re: Can a port scan cause a panic reboot?

Doing some searching through HP's knowledge base:

Title: system panic: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000576913-3
Submitted Date: 2007-01-13 12:00:00.0
Last Modified Date: 2009-01-16 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000576913

Title: Panic during cell OL*: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000985417-16
Submitted Date: 2009-11-06 12:00:00.0
Last Modified Date: 2010-03-11 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000985417

Content starts here
Title: panic in perfmon: Fault when executing in kernel mode
Document ID: ttr_na-SSB_1000813791-2
Submitted Date: 2008-05-27 12:00:00.0
Last Modified Date: 2008-10-09 12:00:00.0
http://www13.itrc.hp.com/service/cki/docDisplay.do?docLocale=en&docId=ttr_na-SSB_1000813791

Search results from TKB:
http://www13.itrc.hp.com/service/james/search.do?mode=text&searchString=Fault+when+executing+in+kernel+mode&submit1=Search+%C2%BB&searchCrit=exactphrase&docTypeAll=yesX&docType=Advisories&docType=SecurityBulletins&docType=EngineerNotes&docType=Drivers&docType=Manuals&docType=Patch&docType=WhitePapers&docType=Forums&dateSearchType=lastXdays&dateRange=all&startDateYear=1999&startDateMonth=0&startDat...
Laurent Menase
Honored Contributor

Re: Can a port scan cause a panic reboot?

I see only 2 possibility:
1) Ask support to analyze the crash dump
2) check all hpux security bulletins at
https://www13.itrc.hp.com/service/cki/secBullArchive.do?admit=109447627+1268684038357+28353475
Laurent Menase
Honored Contributor

Re: Can a port scan cause a panic reboot?

look for Remote Denial of service in the set of Security bulletins.