Simple DoS

[Ivan Voras]

Nejc Škoberne wrote:
> Hello,
> 
> yesterday one of our clients did something interesting (stupid): they
> connected both ends of an UTP cable to the same switch, to which our
> FreeBSD server was also connected. The server was immediately completely
> unresponsive from yesterday evening until this morning, when our tech
> guy went there to see what the problem was. Even when they rebooted
> the FreeBSD machine, it wouldn't boot normally - disk I/O was very
> busy and everything was happening unusably slow. After the disconnect
> from that switch, everything went back to normal.
> 
> Any ideas how to prevent such situations in the future? (I would like
> to do it on the server side, not on the "user side".)

First you need to identify what really happened. The story as you tell
it has much unknown. What does the server do? Is it forwarding packets
so they got stuck in a loop?

High disk I/O suggests you have firewall enabled with logging, so every
discarded (?) packet generated a log message. If you're using syslog you
can tell it not to sync after every message and thus lower the I/O load.
If you don't need to inspect the logs, disable the logging.