Mailing List Archive

excess ip fragments from client cause denial of service
Folks,

Here's an FYI, in case anyone else runs into this issue. And perhaps
you may feel moved to contact NetApp about it as well, if your filers
might be similarly affected:

Over the weekend we experienced several instances where clients (mostly
NFS) were unable to transfer data to & from the filer. These outages were
intermittent, but would last up to a half-hour.

To make a long story short, we traced the problem to a single NFS client
running RedHat-7.3. Disconnecting the errant client from the network
caused the problems to cease immediately. RedHat has released a fix,
discussed at:
http://rhn.redhat.com/errata/RHBA-2002-110.html

Once the immediate problem was solved (and similar client systems patched),
we still were disturbed that a single buggy client (100Mbit) could take out
our F820 with gigabit ethernet (there was almost no other filer activity
at the time of the incidents). We entered a case with NetApp support,
who directed me to their already-existing bug/RFE #72769, along with their
recommendations ("fix the client"). The bug is not scheduled to be fixed.

Since we are on a mostly-open network, and since we do not control the
software installed on all our client machines, we are very concerned about
the potential for future denial-of-service incidents, whether accidental
or deliberate. As a result, we have asked NetApp to fix the bug.

As I said, I'm mostly posting this item here so others can be on guard
against the issue -- it was certainly unexpected by us.

Regards,

--
Marion Hakanson <hakanson@cse.ogi.edu>
CSE Computing Facilities