rpcbind - file descriptors

[Malcolm McKenzie]

I have a problem with the rpcbind process, it is collecting open file descriptors but not letting them go (I am monitoring using lsof). As it reaches it's limit we get the message "rpcbind - too many open files" in our syslog. Example line of output from lsof below:

rpcbind 26977 root 17u inet 72,0x72 0t0 TCP 67.250.61.40:* (BOUND)

If anyone has any ideas what could cause this I'd like to know.

[Steven Sim Kok Leong]

Hi,

From the security perspective, is someone trying to launch a denial of service attack on you across the network?

If you never had such encounters in the past, check the IP addresses that are connecting to your server. Are they legitimate?

Hope this helps. Regards.

Steven Sim Kok Leong

[Mark Greene_1]

run rpcinfo and see what/how many IP addresses are listed. Also, are you exporting alot of filesystems over NFS?

--
mark

[Malcolm McKenzie]

The ip addresses do not seem to be recognisable and the addresses from rpcinfo do not match. All the open files have end in .40. Any more ideas?

[Steven Sim Kok Leong]

Hi,

Block this IP address out from your network-based firewall and check if this solves your problem.

Hope this helps. Regards.

Steven Sim Kok Leong

[Malcolm McKenzie]

Thanks but the ip address mentioned is only an example. Here are ten more:

rpcbind 19754 root 101u inet 72,0x72 0t0 TCP 73.124.89.40:* (BOUND)
rpcbind 19754 root 102u inet 72,0x72 0t0 TCP 67.35.5.40:* (BOUND)
rpcbind 19754 root 103u inet 72,0x72 0t0 TCP 81.80.77.40:* (BOUND)
rpcbind 19754 root 104u inet 72,0x72 0t0 TCP 75.0.9.40:* (BOUND)
rpcbind 19754 root 105u inet 72,0x72 0t0 TCP 67.36.1.40:* (BOUND)
rpcbind 19754 root 106u inet 72,0x72 0t0 TCP 79.4.49.40:* (BOUND)
rpcbind 19754 root 107u inet 72,0x72 0t0 TCP 71.204.193.40:* (BOUND)
rpcbind 19754 root 108u inet 72,0x72 0t0 TCP 73.56.65.40:* (BOUND)
rpcbind 19754 root 109u inet 72,0x72 0t0 TCP 73.32.137.40:* (BOUND)
rpcbind 19754 root 110u inet 72,0x72 0t0 TCP 72.156.133.40:* (BOUND)

The only thing in commons is the .40?

[Malcolm McKenzie]

I was using an lsof binary not matched to my kernel. I recompiled lsof and the output from lsof now makes sense, the problem is with a firewall - thanks for the responses.