finding the port for "kernel: Limiting open port RST response from x to y packets/sec"

[nusenu]

Hi,

I occasionally get multiple entries of:

kernel: Limiting open port RST response from xxxx to yyy packets/sec

in /var/log/messages.

Is there a way to find out which specific TCP port is getting hammered
or any other additional debug information related to these log entries?
(the server has multiple open and publicly reachable open TCP ports)


thanks,
nusenu



--
https://twitter.com/nusenu_
https://mastodon.social/@nusenu

[Michael Sierchio]

On Sat, Aug 25, 2018 at 11:34 AM nusenu <nusenu...@riseup.net> wrote:

>
> kernel: Limiting open port RST response from xxxx to yyy packets/sec

> Is there a way to find out which specific TCP port is getting hammered

> or any other additional debug information related to these log entries?
> (the server has multiple open and publicly reachable open TCP ports)
>

You can identify and log these packets in IPFIREWALL (man ipfw).

You can also set sysctl net.inet.tcp.log_debug=1
--
"Well," Brahma said, "even after ten thousand explanations, a fool is no
wiser, but an intelligent person requires only two thousand five hundred."

- The Mahābhārata
_______________________________________________
freebsd-...@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questi...@freebsd.org"

[nusenu]

Hello Michael,

thanks for your reply.

Michael Sierchio:

>> Is there a way to find out which specific TCP port is getting hammered
>> or any other additional debug information related to these log entries?
>> (the server has multiple open and publicly reachable open TCP ports)
>>
>
> You can identify and log these packets in IPFIREWALL (man ipfw).
>
> You can also set sysctl net.inet.tcp.log_debug=1

unfortunately net.inet.tcp.log_debug=1 logs too much (I should only get my
IP and port, but not the other side's).

I assume there are many potential reasons why the kernel would reply
with an RST on an open port, are there pre-existing rulesets that
match the kernel's reasons?

[nusenu]

nusenu:

> Hi,
>
> I occasionally get multiple entries of:
>
> kernel: Limiting open port RST response from xxxx to yyy packets/sec

an additional question related to this:

Is this something you would commonly see on a publicly facing server
and is nothing to worry about or does this warrant some additional digging?

thanks,
nusenu