Pharyngula

Pharyngula has moved to http://scienceblogs.com/pharyngula/

Tuesday, June 22, 2004

Aaargh.

This machine has been acting very peculiar today—it was more or less inaccessible most of the morning. It was a very strange thing, too; when I sat down at the physical computer, I could reboot it, start tinkering, and everything would work fine for a minute or two. Then it would start getting slower and slower, eventually freezing up nearly completely. It bogged down fast enough that I wasn't even able to fire up any diagnostic software before it would lock up. I couldn't do any work on the machine directly, but I discovered that if I booted it up and accessed it only via ssh, I'd have maybe 30 minutes at a time before the creeping cruds would immobilize everything, so I was able to do a piece-by-piece backup of the essentials.

Then I discovered that if I unplugged the ethernet cable and rebooted, it worked fine. That's very suspicious. Now I've gone through and disabled all the absolutely non-essential network services, turned on the firewall, and everything seems to be cruising smoothly for now.

Any computer experts out there? Was I getting hit with a DOS attack or something? Mac OS X usually seems pretty resilient about that sort of thing, and shrugs off most of the worms and other nasties going around, but the way it was getting hammered into unusability briefly after going live onto the net was awfully suggestive.


Trackback url: http://pharyngula.org/index/trackback/826/BXq7MVaF/

Comments:
#3671: Jaquandor — 06/22  at  10:50 AM
Do you run AdAware? There's a lot of spyware that will gum things up, including one called "Dealhelper" that really gave me fits a month or so ago. Try Googling Dealhelper for instructions on how to find it and get rid of it, if that's the problem.



#3672: — 06/22  at  11:07 AM
Connectivity was intermittent this morning from my work IP.

Or, maybe some hacker was attacking, some slacker was crakcing, was rap-rap-rap-rapping, tap-tap-tapping, on your precious data stores.
Or maybe it was user error and/or software conflict, and nothing more.



's avatar #3673: PZ Myers — 06/22  at  11:14 AM
No adware, no spyware—this is a Mac OS X server. It's fairly clean.

I know it started failing around 6 this morning. People were getting through intermittently, but all was slow. My first thought was hardware error; the hard disk was going nuts for a while.

It's weird. Everything is working now, but I'm on tenterhooks waiting for something else to go wrong.

PZ Myers
Division of Science and Math
University of Minnesota, Morris



#3674: Charlie Wagner — 06/22  at  01:11 PM
PZ wrote:

Then I discovered that if I unplugged the ethernet cable and rebooted, it worked fine. That's very suspicious.

But it's a clue...that points to the ethernet card. Change it and see what happens...



#3675: — 06/22  at  02:12 PM
That activating the firewall and de-activating inessential services seems to have helped is a clue, too. You can use ipfw to check for signs of an attack ('ipfw show' or 'ipfw -at list'), here's the man page:

http://www.freebsd.org/cgi/man.cgi?query=ipfw&sektion=8


Alternatively, you can use an ipfw graphical front end like BrickHouse, avalable at:

http://brianhill.dyndns.org/site/index.php

to facilitate viewing of the firewall log information. BrickHouse also allows some more flexibility in configuring the OS X (ipfw) firewall as compared to the stock sharing preference pane. I haven't used it since my 10.1 days, but the notes say that the latest release (1.2b12) works in 10.3.



#3676: Sean D. Hurley — 06/22  at  02:14 PM
What about your referrer logs?



's avatar #3677: PZ Myers — 06/22  at  02:54 PM
Yikes. ipfw tosses out lots of numbers at me, and I have no idea what they mean. I'm tinkering with BrickHouse, but it's going to take a while to digest it all.

I guess I'm going to have to dive in, though. Things are working mostly fine right now, except that I notice PostFix has stopped delivering the mail.

I don't see anything unusual (other than an abrupt dropoff) in the referrer logs—but I don't think this would have been an attack on the http port, anyway.

PZ Myers
Division of Science and Math
University of Minnesota, Morris



#3725: Hans Selye — 06/24  at  06:44 AM
The true scientist never loses the faculty of amazement. It is the essence of his being.



Page 1 of 1 pages

Next entry: The Hedgehog Response Network

Previous entry: Thalassocnus

<< Back to main

Info

email PZ Myers
Search
Archives
UMM—America's best public liberal arts college