Berkeley CSUA MOTD:Entry 15915
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2025/05/24 [General] UID:1000 Activity:popular
5/24    

1999/6/7-9 [Computer/Networking, Computer/SW/OS/Solaris, Computer/SW/Unix] UID:15915 Activity:high
6/7     My Solaris 2.6 Ultra 5 machine is in a weird state.  It's out of
        sockets!  I do a netstat and there are 32,000+ sockets, most of them
        from a port on localhost to another port one on localhost.  And
        most of them are in the TIME_WAIT state.  But they are not being
        reclaimed.  lsof doesn't help.  The TIME_WAIT ports don't show up.
        Any ideas on how I candiagnose this?  Is the TIME_WAIT timeout
        configurable?  Can I turn on more logging?  I've shut down all
        major user processes and the sockets are still not being
        reclaimed.  Any help would be appreciated.  I don't want
        to reboot until I've learned as much as I can.  Thanks.
                                                        -- azarm
                \-do you know what client programis causing this
                [it isnt ldap by any chance is it?] if this is a machine
                you are root on, i might know how to deal with it [which is
                slightly different than fix it]. will let you know if i can
                remember the exact ndd magic. --psb
                \_ ummm.  also make sure you check the recommended patch
                  list for 2.6 before you start jumping through hoops like
                    the overworked stunt animal that you are :)
                \_ Sounds like a classic half-open attack.  Remote machine
                   sends all sorts of spoofed 127.0.0.1 connections, and
                   most OS's don't see that you can't have 127.0.0.1 stuff
                   coming in the Ethernet interface.  Solution: do a
                   deny on 127.0.0.1 on your incoming router, or block
                   it with natd or ipfilter or something.
        \_ I did more research.  14000 of the sockets are to a port that's
           snmpdx is using (an SNMP daemon process).  1000 are ftp sockets
           to a known machine and another 1000 are sendmail sockets to
           another known machine.  I have nightly script to mail and ftp.
           The scripts work fine (without socket leakage) on other machines.
                \_ Checked your patch level lately?
            \_ tcp sockets to a snmp port?  UH, no -- SNMP runs on UDP. -ERic
        \_ TIME_WAIT sockets don't count against the 1024 limit. -ausman
2025/05/24 [General] UID:1000 Activity:popular
5/24    

You may also be interested in these entries...
2012/3/29-6/4 [Computer/HW/Memory, Computer/HW/CPU, Computer/HW/Drives] UID:54351 Activity:nil
3/29    A friend wants a PC (no mac). She doesn't want Dell. Is there a
        good place that can custom build for you (SSD, large RAM, cheap video
        card--no game)?
        \_ As a side note: back in my Cal days more than two decades ago when
           having a 387SX made me the only person with floating-point hardware,
           most machines were custom built.
	...
2012/1/19-3/3 [Computer/Networking, Politics/Foreign/Europe, Computer/SW] UID:54294 Activity:nil
1/19    Transcript between the Italian cruise ship captain and the Port
        Authority
        http://www.csua.org/u/v9i (abcnews.go.com)
        This captain is amazing.
	...
2011/11/8-30 [Computer/SW/Security, Computer/SW/OS/Windows] UID:54218 Activity:nil
11/8    ObM$Sucks
        http://technet.microsoft.com/en-us/security/bulletin/ms11-083
        \_ How is this different from the hundreds of other M$ security
           vulnerabilities that people have been finding?
           \_ "The vulnerability could allow remote code execution if an
               attacker sends a continuous flow of specially crafted UDP
	...
2011/2/6-19 [Computer/Networking] UID:54028 Activity:nil
2/5     hmm.
$netstat -at | grep LISTEN
tcp        0      0 *:43300                 *:*                     LISTEN
        \_ this is an sshd
tcp        0      0 *:49416                 *:*                     LISTEN
tcp        0      0 *:36201                 *:*                     LISTEN
	...
2009/11/13-30 [Computer/SW/Unix] UID:53523 Activity:nil
11/12   How does one find out if a system has rootkit installed?
        \_ Unix or m$?
           \_ Unix. On M$ I always assume it's compromised.
              \_ Install Tripwire before you plug your server into The Net?
                 The only other answer I can think of is to reinstall the
                 OS from scratch on another server and do an md checksum
	...
2009/11/4-17 [Computer/SW/P2P, Computer/Networking, Computer/SW/Security] UID:53495 Activity:nil
11/4    Holy cow, I got a warning from my ISP that they were notified
        by BSA/baytsp.com that I was copying music/video/software.
        Do they do port scan or something? That's a first for me.
        \_ They hang out on P2P networks and track IP addresses.  -tom
           \_ I believe they are paid by content providers to perform this
              monitoring service, so you should only run this risk with content
	...
2009/10/1-21 [Computer/SW/WWW/Browsers] UID:53417 Activity:moderate
10/1    I am thinking of installing firefox on soda under my home directory.
        Will this make me a hozer?
        \_ Possibly. I wonder if we should have another VM for that...btw,
           I remember someone saying they're glad we're not on FreeBSD
           anymore, but last I checked, a bunch of our stuff is on FreeBSD,
           but our login server is not.
	...
2009/9/10-15 [Computer/SW/Mail] UID:53353 Activity:nil
9/9     What should outbound mail server be when reading mail from soda
        with IMAP? Is there a FAQ?
        \_ It's <DEAD>mail.csua.berkeley.edu<DEAD> (same as for incoming mail).
           \_ "The message could not be sent because connecting to SMTP
               server <DEAD>mail.csua.berkeley.edu<DEAD> failed. The server may
               be unavailable or is refusing SMTP connections."
	...
2010/2/8-18 [Computer/SW/Apps/Media, Computer/SW/Apps] UID:53695 Activity:kinda low
2/5     I like Adobe Flash. When written correctly, it scales along
        with your browser size. It looks consistent on every single
        browser. It is predictable. On the other hand, I'm not a big
        fan of CSS/HTML, which for the most part, look wildly different
        between browsers, and don't even work consistently or
        correctly at times. So why do so many people (like Steve Jobs)
	...
2009/10/27-11/3 [Computer/SW/Unix] UID:53475 Activity:nil
10/27   http://www.maxgames.com/play/flash-mind-reader.html
        how does this work?
        \_ sh -c 'for ((i=0;i<10;i++)); do for ((j=0;j<10;j++)); do echo "$i$j-(\
$i+$j)" | bc; done ; done' | uniq
        \_ bash -c 'for ((i=0;i<10;i++)); do for ((j=0;j<10;j++)); do echo "$i$j\
-($i+$j)" | bc; done ; done' | uniq
	...
2009/4/20-23 [Computer/SW/Database] UID:52876 Activity:nil
4/19    ORCL u SUNW = ORCL.
        What is Larry Ellison thinking? What is he going to do with a bunch of
        legacy Sun hardware that no one uses anymore, its fading workstation
        customer base, and open source Sun MySQL that doesn't even generate
        revenue? I really don't get all this acquisition business.
        \_ A lot of big companies still use big, fat Sun hardware. Or use
	...
2009/1/15-23 [Computer/SW/OS/OsX] UID:52398 Activity:nil
1/15    can any serious development be done on OSX that is not *for OSX*.
        i'll grant that ruby on rails has excellent tutorials for the mac.
        discuss:
        \_ What kind of serious development?  If you want to use the standard
           OSX ui then your ui code will be pretty much useless elsewhere,
           but that's why concepts like MVC are so important.  Otherwise
	...
2008/11/29-12/6 [Computer/SW/OS/FreeBSD, Computer/SW/OS/VM] UID:52129 Activity:moderate
11/29   I'm experimenting with virtualization, and as a poor college student
        I'm wondering what the best alternatives for virtualization are, and
        how best to cut my teeth on messing with non-linux platforms (or I
        guess interesting stuff on Linux would work too). Right now I've got
        FreeBSD7 running on KVM on my home computer (on a Core 2 Quad), and am
        somewhat at a loss as to how to use it. (More details: bridged
	...
2008/11/14-26 [Computer/SW/Languages/Java, Computer/SW/OS/Solaris] UID:51970 Activity:moderate
11/13   http://sfgate.com/cgi-bin/article.cgi?f=/n/a/2008/11/14/financial/f051352S72.DTL
        http://preview.tinyurl.com/6nngpm
        Sun Microsystems Inc. plans to cut up to 6,000 jobs, or 18 percent of
        its global work force, as sales of its high-end computer servers have
        collapsed.  The drastic move announced Friday highlights Sun's
        desperation to cut costs and survive as an independent company. Sun's
	...
2008/11/14-26 [Computer/SW/OS/Linux, Computer/SW/OS/Solaris] UID:51989 Activity:moderate
11/14   lulz why doesn't GOOG buy JAVA i mean SUN i mean whatever the hell they
        are these days.
        \_ Even GOOG isn't THAT stupid
           \_ Sorry, but WHY would Google do something like that? They
              run 99.2% Linux servers on the backend. They don't use
              Solaris for development. I mean, what does Sun have to
	...
2008/9/24-29 [Computer/SW/OS/Windows, Computer/SW/OS/Solaris] UID:51283 Activity:nil
9/24    Why is nscd going crazy?  DoS?
        \- back in the solaris say 2.5-2.6 era, it had both some bugs
           (some malformed nis maps made it go crazy) and architectural
           flaws in the IPC/door+threading mechanism. if you are running
           OS-recent, dunno, but you can trace it.
           \_ Yeah, I think it's just buggy.  I've restarted it, and it seems
	...
2008/4/3-9 [Computer/SW/Languages/Misc, Computer/SW/OS/Solaris] UID:49658 Activity:nil
4/3     Solaris experts: I've never played with ZFS. Does it have a native
        dump command a la ufsdump?
        \_ This might be what you are looking for:
           http://preview.tinyurl.com/2xqkda [sun - bigadmin]
	...
2008/3/30-4/6 [Computer/SW/OS/Solaris] UID:49614 Activity:nil
3/30    Question: I just deleted 60 GB of files from an 80 GB disk. The
        disk activity lights were blinking like crazy and I could hear the
        drive crunch while the data was deleted. This is under Solaris.
        Anyway, I think UNIX uses unlink() when files are deleted. Shouldn't
        it just update the free list on the superblock and call it a day?
        What is all the crunching about?
	...
2007/11/27-30 [Computer/SW/Languages/C_Cplusplus, Computer/SW/OS/Solaris] UID:48701 Activity:high
11/27   I'm using select to do a nonblocking check to see if a single socket
        has anything to read off it.  Problem is, I can have up to 12228
        file descriptors, and Linux fd_set only supports up to 4096.  Any idea
        what I can do about this?  (Or a better solution?) -jrleek
        \- 1. who are you
           2. i am busy this week and you didnt mention language
	...
2012/9/20-11/7 [Computer/SW/Unix, Finance/Investment] UID:54482 Activity:nil
9/20    How do I change my shell? chsh says "Cannot change ID to root."
        \_ /usr/bin/chsh does not have the SUID permission set. Without
           being set, it does not successfully change a user's shell.
           Typical newbie sys admin (on soda)
           \_ Actually, it does: -rwsr-xr-x 1 root root 37552 Feb 15  2011 /usr/bin/chsh
	...
2012/5/8-6/4 [Computer/SW/Unix] UID:54383 Activity:nil
5/8     Hello everyone!  This is Josh Hawn, CSUA Tech VP for Spring 2012.
        About 2 weeks ago, someone brought to my attention that our script
        to periodically merge /etc/motd.public into /etc/motd wasn't
        running.  When I looked into it, the cron daemon was running, but
        there hadn't been any root activity in the log since April 7th.  I
        looked into it for a while, but got lost in other things I was
	...
2012/2/9-3/26 [Computer/SW/Security, Computer/SW/Unix] UID:54305 Activity:nil
2/9     Reminder: support for mail services has been deprecated for *several
        years*. Mail forwarding, specifically .forward mail forwarding, is
        officially supported and was never deprecated.
        \_ There is no .forward under ~root.  How do we mail root and how do
           we get responses?
           \_ root@csua.berkeley.edu is and always has been an alias.
	...
2011/9/14-12/28 [Computer/SW/Unix] UID:54172 Activity:nil
9/12    We've restored CSUA NFS to something vaguely resembling normal
        functionality -- plus, with some luck, we should now have something
        vaguely resembling normal uptime, too!  Ping root@csua.org if you
        notice any problems.  --jordan
--------------------------------------------------------------------------------
        \_  Oh, and http://irc.CSUA.Berkeley.EDU is online again.
	...
2011/6/5-8/27 [Computer/HW/Memory] UID:54127 Activity:nil
6/5     In an effort to stabilize our services, we'll be rebuilding parts of
        the CSUA infrastructure over the course of this summer.  To give us
        some wiggle room, I've temporarily decreased soda's allocated RAM from
        8GB to 2GB.  If you need to run something that requires large amounts
        of memory, please send mail to root@csua.org and we'll try to
        accommodate your request.  --jordan
	...
2011/4/27-7/30 [Computer/SW/Security, Computer/SW/Unix] UID:54096 Activity:nil
4/28    Will wall be fixed?   - jsl
        \_ What's wall?
           \_ An anachronism from a bygone era, when computers were hard to
              comeby, the dorms didn't have net, there was no airbears, and
              when phones didn't come standard with twitter or sms.
           \_ A non useful implementation of twitter.
	...
2011/5/19-7/30 [Computer/SW/Security] UID:54110 Activity:nil
5/19    Uh, is anyone still using this? Please mark here if you post and
        haven't added this yet. I'll start:
        \_ person k
        \_ ausman, I check in about once a week.
        \_ erikred, twice a week or so.
        \_ mehlhaff, I login when I actually own my home directory instead of
	...
2010/12/13-2011/2/19 [Computer/SW/Unix] UID:53978 Activity:nil
12/21   Help, all my files are owned by nobody! -ausman
        (yes I emailed root)
        \_ Things should be fine now. As usual, the NFS server caused a cascade
           of errors.
	...