Re: xinetd bug or new DoS attack?

>The service is disabled for 15 seconds when the connection 
>rate is too high? 

Nooo. This bug is more like the tcp/wait problem. It causes
xinetd to go into a tight loop sending syslog messages. The only
way to break the loop is to close the descriptor and remove it
from the select mask. 

The bug he described was that the per process fd limit was
exhausted. This means accept fails, which causes it to go back to
select, and the listening descriptor is still readable, accept
fails again, etc. This is easy to do since linux has about a 2
minute turn around on used descriptors due to so_linger.

Its been my experience that its rare to hit the per process limit
in most situations, but it is there. This is a different problem
than cps.

-Steve Grubb

__________________________________
Do you Yahoo!?
Yahoo! Hotjobs: Enter the "Signing Bonus" Sweepstakes
http://hotjobs.sweepstakes.yahoo.com/signingbonus