Re: Leak in BOPM

On Sun, Aug 22, 2004 at 04:00:59PM -0400, tabris wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Sunday 22 August 2004 3:13 pm, Andy Smith wrote:
> > On Sun, Aug 22, 2004 at 12:02:28PM -0700, Erik Fears wrote:
> > > Are you sure this is a leak and not the scan queue filling up.
> > > There is no max limit on the scan queue, so if your scanner can't
> > > keep up then it will quickly fill up your memory.
> 	Hmmm. is there an easy way to run 2 or 3 'central' BOPMs that each scan 
> a set of servers? I can't put BOPMs on all the leaves, partly b/c I 
> don't operate all of the leaves.

Unless your network has tens of thousands of users, or your scanning
machine is very low on resources, there should be no need.  Tell us
what the connect rate is, and also what you have your maximum number
of fds set to, both in the bopm.conf and in "ulimit -a" from the
shell.

> > Yes, tabris, please let us know these stats:
> 	Hmm. I'll get back to you with those in a couple hours. I had the bot 
> set with umode d b/c of how noisy the stats channel is. (and i'll stop 
> the periodic KILLs).
> 
> 	Any chance we can change the trigger to something like !stat or !bopm 
> stat ? (yes, i'm sure I could hack the code, but I am thinking I might 
> not be the only one to care)

That sounds a bit mad as it would only really help you if no one is
in the stats channel.  In that case why not just ask for an option
to make bopm run silently only logging this stuff to file..

Anyway try "!all stat" and "!all fdstat".

> One idea from a friend is a combined nmap/bopm, that first scans for 
> open ports, filters out a couple of the more obvious non-proxy ports 
> (say 22, 25, 110, 135-139 etc), then scans all of them. I think it 
> might take too long to scan, but it is an idea anyway.

Needs root.  Will generate more abuse reports.

-- 
Andy Smith -- Occasional BOPM Developer And Support Monkey.  Please copy
all BOPM support queries to the BOPM list, _not_ just directly to me!
If I've helped you with BOPM then please check my wishlist!
http://www.amazon.co.uk/exec/obidos/registry/23IJ4U7N4J3X9

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (FreeBSD)

iD8DBQFBKRETIJm2TL8VSQsRAlJWAJ9hk08GZLOswfC4jV3+1Mx6QDs0hACePzDD
niePQ+ObtVFDuJBmBizqUCQ=
=9opd
-----END PGP SIGNATURE-----