Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

we have the following output from dmesg:

__ratelimit: 33491 callbacks suppressed
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow
TCP: time wait bucket table overflow

Also we have the following setting:

cat /proc/sys/net/ipv4/tcp_max_tw_buckets
524288

We are under some kind of attack, but we could not detect what cause this problem?

share|improve this question
    
We increased /proc/sys/net/ipv4/tcp_max_tw_buckets to 720000 but with no luck –  divaka Nov 17 '12 at 18:12
    
Is there any reasonable limit of the above setting? We increased it to 1000000 and now the things look very well by now? –  divaka Nov 17 '12 at 19:13
    
If you increase it, the attack will do more harm since you are allowing it to consume more memory. Is there some good reason you are increasing it? (Do you have plenty of memory to spare?) –  David Schwartz Nov 18 '12 at 1:05

2 Answers 2

up vote 1 down vote accepted

Try the following commands to determine if you have a lot of connections coming from one address or if you are under a distributed attack.

netstat -nt | cut -c 40- | cut -d: -f1 | sort | uniq -c | sort -n
netstat -nt | cut -d: -f2 | sort | uniq -c | sort -n

If you have high numbers from a few IP addresses it will be easier to limit the connections. You can then add deny rules or rate-limit rules to iptables to limit access from these addresses.

If you are under attack you may want to get your ISP involved as they can limit connections before they reach you.

share|improve this answer

I would use also tcpdump and sniff little bit on interface to see what's coming there. There you'll be able to see what's actually happening and what's coming to you.

Here's also quick explanation how it works, in case you didn't use it before:

http://openmaniak.com/tcpdump.php

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.