kern/130605: Certain hardware produces "Network is unreachable" errors for scanning tools

[Jason Chambers]

>Number:         130605
>Category:       kern
>Synopsis:       Certain hardware produces "Network is unreachable" errors for scanning tools
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Jan 16 06:10:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Jason Chambers
>Release:        7.1
>Organization:
UCLA
>Environment:
FreeBSD box 7.1-RELEASE-p2 FreeBSD 7.1-RELEASE-p2 #3: Thu Jan  15 21:39:37 PST 2009     user at box:/usr/obj/usr/src/sys/UCLA7-64  amd64
>Description:
On certain hardware platforms FreeBSD has problems issuing multiple outbound requests as typically seen with network security auditing tools.

The current hardware platform in question is a Dell PowerEdge SC1435.  I have 4 of these servers and all exhibit the same symptoms. 

As an example, NMAP or Nessus fails to perform reconnaissance.  Nessus does not produce much for errors; numerous "BIOCSRTIMEOUT: Invalid argument" pcap related error lines are found in the nessusd.dump log.  The "scan" finishes within 6 seconds with the conclusion that all hosts are dead.  The same Nessus build works without incident on other hardware platforms running the same version of FreeBSD.  Using TCPDUMP I can see that requests are being sent on the network and the associated replies are being returned.

Nmap is unable to scan a system because it immediately goes into a loop of the following:

  sendto in send_ip_packet: sendto(4, packet, 44, 0,
   xxx.xxx.xxx.xxx, 16) => Network is unreachable

  Offending packet: TCP xxx.xxx.xxx.xxx:55555 > xxx.xxx.xxx.xxx:80
   S ttl=56 id=xxxx iplen=11264  seq=xxxx win=1024 <mss 1460>

  Sleeping 15 seconds then retrying

  sendto in send_ip_packet: sendto(4, packet, 44, 0,
   xxx.xxx.xxx.xxx, 16) => Network is unreachable

  Offending packet: TCP xxx.xxx.xxx.xxx:55555 > xxx.xxx.xxx.xxx:80
   S ttl=56 id=xxxx iplen=11264  seq=xxxx win=1024 <mss 1460>

  Sleeping 60 seconds then retrying


The same "Network is unreachable" messages appear if I attempt to ping a host while a Nessus scan is running.
 

I found a PR from a long time ago (2006) that appears relevant but it was
abandoned.  Making updates to that PR does not kick off an email to the FreeBSD-bugs mailing list so I made the conclusion that it is not working with GNATS correctly and decided to open a new PR.

http://www.freebsd.org/cgi/query-pr.cgi?pr=102741&cat=



I tried using a different network controller (bge vs em) but this had no effect.

I have dedicated one of these systems to troubleshooting this problem if anyone would like to provide pointers towards further debugging.  


Regards,

--Jason



>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: