Колеги дайте съвет
0 отговора
120 прегледа
Колеги дайте съвет
Значи проблемът е следния от единия влан на мрежата в който има над 200 потребителя вечерно време и то предимно през уикенда започна да тече някакъв флуд или по скоро ДОС ето и лога.
Jan 17 00:32:08 SuSE-linux kernel: NET: 19225 messages suppressed.
Jan 17 00:32:08 SuSE-linux kernel: martian source 210.51.191.28 from 0.214.43.195, on dev eth1.5
Jan 17 00:32:08 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:08 SuSE-linux kernel: NET: 19206 messages suppressed.
Jan 17 00:32:08 SuSE-linux kernel: martian source 200.155.4.34 from 196.156.88.53, on dev eth1.5
Jan 17 00:32:08 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:09 SuSE-linux kernel: NET: 18834 messages suppressed.
Jan 17 00:32:09 SuSE-linux kernel: martian source 211.161.43.186 from 248.83.128.205, on dev eth1.5
Jan 17 00:32:09 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:00:00:28
Jan 17 00:32:09 SuSE-linux kernel: NET: 19106 messages suppressed.
Jan 17 00:32:09 SuSE-linux kernel: martian source 61.129.75.69 from 0.6.80.127, on dev eth1.5
Jan 17 00:32:09 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:10 SuSE-linux kernel: NET: 18753 messages suppressed.
Jan 17 00:32:10 SuSE-linux kernel: martian source 210.51.191.28 from 119.152.250.145, on dev eth1.5
Jan 17 00:32:10 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:10 SuSE-linux kernel: NET: 20036 messages suppressed.
Jan 17 00:32:10 SuSE-linux kernel: martian source 211.154.211.86 from 24.103.105.84, on dev eth1.5
Jan 17 00:32:10 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:11 SuSE-linux kernel: NET: 19702 messages suppressed.
При 20000 заявки в секунда нищо чудно, че машината се товари въпроса, е че
това което би трябвало да е МАС адреса на машината която го прави 00:0c:6e:64:bd:5e се оказва че не е МАС на нито една от машините.
Също така кода за протокол 08:00:45:08:00:28 показва IP а мониторите не го отчитат.
Добрия Интернет струва пари!!!
Jan 17 00:32:08 SuSE-linux kernel: NET: 19225 messages suppressed.
Jan 17 00:32:08 SuSE-linux kernel: martian source 210.51.191.28 from 0.214.43.195, on dev eth1.5
Jan 17 00:32:08 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:08 SuSE-linux kernel: NET: 19206 messages suppressed.
Jan 17 00:32:08 SuSE-linux kernel: martian source 200.155.4.34 from 196.156.88.53, on dev eth1.5
Jan 17 00:32:08 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:09 SuSE-linux kernel: NET: 18834 messages suppressed.
Jan 17 00:32:09 SuSE-linux kernel: martian source 211.161.43.186 from 248.83.128.205, on dev eth1.5
Jan 17 00:32:09 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:00:00:28
Jan 17 00:32:09 SuSE-linux kernel: NET: 19106 messages suppressed.
Jan 17 00:32:09 SuSE-linux kernel: martian source 61.129.75.69 from 0.6.80.127, on dev eth1.5
Jan 17 00:32:09 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:10 SuSE-linux kernel: NET: 18753 messages suppressed.
Jan 17 00:32:10 SuSE-linux kernel: martian source 210.51.191.28 from 119.152.250.145, on dev eth1.5
Jan 17 00:32:10 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:10 SuSE-linux kernel: NET: 20036 messages suppressed.
Jan 17 00:32:10 SuSE-linux kernel: martian source 211.154.211.86 from 24.103.105.84, on dev eth1.5
Jan 17 00:32:10 SuSE-linux kernel: ll header: 00:0c:6e:c8:41:42:00:0c:6e:64:bd:5e:08:00:45:08:00:28
Jan 17 00:32:11 SuSE-linux kernel: NET: 19702 messages suppressed.
При 20000 заявки в секунда нищо чудно, че машината се товари въпроса, е че
това което би трябвало да е МАС адреса на машината която го прави 00:0c:6e:64:bd:5e се оказва че не е МАС на нито една от машините.
Също така кода за протокол 08:00:45:08:00:28 показва IP а мониторите не го отчитат.
Добрия Интернет струва пари!!!