Lots of Unsupported protocol errors and high CPU uilization.

Hi,

I have a public  PPTP vpn server on CentOS 5.4 with pptpd v1.3.4

I'm getting lots of 'Unsupported protocol' errors out of the blue. I don't know 
anything about the client that connected to the server but there was no one else 
connected at the time (except myself but I didn't use it at that moment). 


The reason why I noticed it was this:
1) There was a gap from 07:20 to 08:09 in the bandwidth graph where in/out-going 
dropped from about 8 mbit/sec to near zero.
2) There are 8 CPUs. The pppd or pptpd his connection was using was pulling 
about 12% from CPU6. All the rest were at about 1-3%. At the exact same time 
there is a spike in CPU3 up to 20-40% and this spike drops to 1-3% again at 
08:09. 


So the question is this: Did some process start on CPU6 that caused the 
'Unsupported protocol' and the drop in bandwidth utilization? or is it the other 
way round: did his computer cause all the Unsupported protocols which then 
caused pptpd and/or pppd to use another CPU that then got utilized 20-40%? I'm 
leaning towards the later because when he disconnected CPU3 came back down to 
1-3% again. 


I think it's rather alarming. What could cause all this? any ideas at all? I 
don't know how long this has been going on because I only started graphing now 
(the server is new and in betatest).  As you can see he used the connection fine 
for 3 hours prior to this.

Regards,
Tobias

Oct 24 04:16:11 us1 pptpd[30157]: CTRL: Starting call (launching pppd, opening 
GRE)
Oct 24 04:16:11 us1 pppd[30158]: Plugin radius.so loaded.
Oct 24 04:16:11 us1 pppd[30158]: RADIUS plugin initialized.
Oct 24 04:16:11 us1 pppd[30158]: Plugin radattr.so loaded.
Oct 24 04:16:11 us1 pppd[30158]: RADATTR plugin initialized.
Oct 24 04:16:11 us1 pppd[30158]: Plugin /usr/lib/pptpd/pptpd-logwtmp.so loaded.
Oct 24 04:16:11 us1 pppd[30158]: pptpd-logwtmp: $Version$
Oct 24 04:16:11 us1 pppd[30158]: pppd 2.4.4 started by root, uid 0
Oct 24 04:16:11 us1 pppd[30158]: Using interface ppp0
Oct 24 04:16:11 us1 pppd[30158]: Connect: ppp0 <--> /dev/pts/0
Oct 24 04:16:14 us1 pptpd[30157]: CTRL: Ignored a SET LINK INFO packet with real 
ACCMs!
Oct 24 04:16:14 us1 pppd[30158]: MPPE 128-bit stateless compression enabled
Oct 24 04:16:16 us1 pppd[30158]: Cannot determine ethernet address for proxy ARP
Oct 24 04:16:16 us1 pppd[30158]: local  IP address 10.2.0.1
Oct 24 04:16:16 us1 pppd[30158]: remote IP address 10.2.0.2
Oct 24 04:16:16 us1 pppd[30158]: pptpd-logwtmp.so ip-up ppp0 XXXXXXX 
aaa.bbb.ccc.ddd
Oct 24 04:19:49 us1 last message repeated 5 times
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0x5e0d received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0xaf received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0xa6f4 received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0x9a94 received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0xe55 received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0xa85e received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0x18f6 received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0x91 received
Oct 24 07:20:05 us1 pppd[30158]: Unsupported protocol 0x68d received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x2aa0 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x50e1 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x8666 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 'DECnet Phase IV' (0x27) 
received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x1027 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xe9 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 'Encryption' (0x53) 
received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xbb received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x3e43 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xde5b received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x91 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xb7 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xdab4 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x8f received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xa9 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x3609 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0x79 received
Oct 24 07:20:06 us1 pppd[30158]: Unsupported protocol 0xc5 received
.
.
.
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0xd419 received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0xdf received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0x24ff received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 'Multi-Link' (0x3d) 
received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0x3087 received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0x4e43 received
Oct 24 08:08:55 us1 pppd[30158]: Unsupported protocol 0x5eb0 received
Oct 24 08:08:56 us1 pppd[30158]: Unsupported protocol 0xd6fc received
Oct 24 08:08:57 us1 pppd[30158]: Unsupported protocol 0xc651 received
Oct 24 08:08:57 us1 pppd[30158]: Unsupported protocol 0x5 received
Oct 24 08:08:57 us1 pppd[30158]: Unsupported protocol 'Individual Link 
Encryption' (0x55) received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 'Serial Data Transport 
Protocol (PPP-SDTP)' (0x49) received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0xd5 received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0x85 received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0x7ef1 received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0x8eb7 received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0xbd received
Oct 24 08:08:59 us1 pppd[30158]: Unsupported protocol 0x44fa received
Oct 24 08:09:00 us1 pppd[30158]: Unsupported protocol 0x6ed5 received
Oct 24 08:09:00 us1 pppd[30158]: Unsupported protocol 0xcb received
Oct 24 08:09:00 us1 pppd[30158]: Unsupported protocol 0xc8af received
Oct 24 08:09:00 us1 pppd[30158]: Unsupported protocol 'Stream Protocol ST-II' 
(0x33) received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 0xca9f received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 0x1d received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 0x58bc received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 0x89 received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 'single-link compression' 
(0xfb) received
Oct 24 08:09:01 us1 pppd[30158]: Unsupported protocol 0xc0fd received
Oct 24 08:09:01 us1 pppd[30158]: LCP terminated by peer 
(^_M-=bM-P^@<M-Mt^@^@^@^@)
Oct 24 08:09:01 us1 pppd[30158]: pptpd-logwtmp.so ip-down ppp0
Oct 24 08:09:01 us1 pppd[30158]: Connect time 232.8 minutes.
Oct 24 08:09:01 us1 pppd[30158]: Sent 1546748411 bytes, received 898256027 
bytes.
Oct 24 08:09:01 us1 pppd[30158]: Modem hangup
Oct 24 08:09:01 us1 pppd[30158]: Connection terminated.
Oct 24 08:09:01 us1 pppd[30158]: Exit.

------------------------------------------------------------------------------
Nokia and AT&T present the 2010 Calling All Innovators-North America contest
Create new apps & games for the Nokia N8 for consumers in  U.S. and Canada
$10 million total in prizes - $4M cash, 500 devices, nearly $6M in marketing
Develop with Nokia Qt SDK, Web Runtime, or Java and Publish to Ovi Store 
http://p.sf.net/sfu/nokia-dev2dev

_______________________________________________
Poptop-server mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/poptop-server