Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    What is the biggest attack in GBPS you stopped

    Scheduled Pinned Locked Moved
    General pfSense Questions
    33
    737
    508.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Supermule Banned
      last edited by

      Yes. It just doesnt work as expected.

      Until the drop in traffic occurs. So I need to find a way to see whats initiated when the traffic drops.

      1 Reply Last reply Reply Quote 0
      • T
        tim.mcmanus
        last edited by

        @Supermule:

        Yes. It just doesnt work as expected.

        Until the drop in traffic occurs. So I need to find a way to see whats initiated when the traffic drops.

        https://forums.freebsd.org/forums/networking.7/

        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          Yes….one more forum to watch....................... :D

          1 Reply Last reply Reply Quote 0
          • S
            Supermule Banned
            last edited by

            Just a small update..

            Changed NIC's to vmxnet3 in vmware and this happened.

            Youtube Video

            Same traffic drop but curves are different. On E1000 they follow each other. On vmxnet3 they are totally seperated. Red is 15mbit/s and black is almost zero.

            Suddenly then traffic drops on incoming WAN and it begins to flow traffic and respond to ping for Google DNS.

            No change what so ever to anything.

            vmxnet3 drivers are much worse handling this kind of attack than the E1000 drivers.

            EDIT: When Core nr 3 drops, the FW comes alive and begins to route packets. Overall load is cut in half.

            EDIT EDIT:  Getting 100% interrupt in the top -HSP on the console. Again the E1000 almost had zero.

            Logs are flooded with this.

            | Jun 7 19:54:14 | check_reload_status: Reloading filter |
            | Jun 7 19:54:14 | check_reload_status: Restarting OpenVPN tunnels/interfaces |
            | Jun 7 19:54:14 | check_reload_status: Restarting ipsec tunnels |
            | Jun 7 19:54:14 | check_reload_status: updating dyndns Yousee |
            | Jun 7 19:54:01 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:49 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:43 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:38 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:33 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:28 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:22 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:15 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:06 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:53:01 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:56 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:51 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:45 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:40 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:35 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:28 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:23 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:18 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:13 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:07 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:52:02 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:56 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:50 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:46 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:40 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:34 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:29 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:24 | check_reload_status: Reloading filter |
            | Jun 7 19:51:24 | check_reload_status: Restarting OpenVPN tunnels/interfaces |
            | Jun 7 19:51:24 | check_reload_status: Restarting ipsec tunnels |
            | Jun 7 19:51:24 | check_reload_status: updating dyndns Yousee |
            | Jun 7 19:51:22 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:16 | kernel: vmx0: watchdog timeout on queue 0 |
            | Jun 7 19:51:11 | kernel: vmx0: watchdog timeout on queue 0 |

            traffic_drop3.PNG
            traffic_drop3.PNG_thumb
            vmxnet3_vmwareload.png
            vmxnet3_vmwareload.png_thumb
            interrupts_vmxnet.PNG
            interrupts_vmxnet.PNG_thumb

            1 Reply Last reply Reply Quote 0
            • F
              firewalluser
              last edited by

              And an update from me.

              Currently downloading and getting 5.42Mbps according to the dashboard, yet when you did the ddos the otherday that was only giving showing 2.42Mbps.

              So why does a ddos cause my bandwidth to drop down? Could it be related to this post https://forum.pfsense.org/index.php?topic=94903.0 ie a hw issue, or is freebsd or pfsense.

              I have a huwei supplied router dont know if it can go into modem only mode, but if it can I will check the speeds again with this device if you dont mind doing a Britney Spears and hit me one more time?  ;)

              Capitalism, currently The World's best Entertainment Control System and YOU cant buy it! But you can buy this, or some of this or some of these

              Asch Conformity, mainly the blind leading the blind.

              1 Reply Last reply Reply Quote 0
              • S
                Supermule Banned
                last edited by

                No problem.

                Let me know when youre ready and what IP/port it is.

                1 Reply Last reply Reply Quote 0
                • S
                  Supermule Banned
                  last edited by

                  .-….........

                  1 Reply Last reply Reply Quote 0
                  • H
                    Harvy66
                    last edited by

                    How resilient? No longer an issue for established connections as long as there is enough bandwidth, kind of resilient? You tone makes it sound as if it is effectively fixed. Time to party?  8)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Supermule Banned
                      last edited by

                      EDIT: It was my bandwith that caused to attacked IP to survive.

                      No change in resilience. (Sorry).

                      1 Reply Last reply Reply Quote 0
                      • H
                        Harvy66
                        last edited by

                        @Supermule:

                        EDIT: It was my bandwith that caused to attacked IP to survive.

                        No change in resilience. (Sorry).

                        It was your bandwidth? Isn't that the goal? The weakest link should be the bandwidth, not the firewall, yes? What issue(s) still remain? Same?

                        1 Reply Last reply Reply Quote 0
                        • S
                          Supermule Banned
                          last edited by

                          As soon as I was able to push 10mbit/s out on my private line, then it failed again….

                          1 Reply Last reply Reply Quote 0
                          • H
                            Harvy66
                            last edited by

                            So 10Mb/s of special traffic against your greater than 10Mb/s link caused the link to fail? Did the firewall stop working or only the link go down?

                            1 Reply Last reply Reply Quote 0
                            • S
                              Supermule Banned
                              last edited by

                              Firewall stopped routing traffic. Link was fine.

                              Lots of packetloss once again.

                              1 Reply Last reply Reply Quote 0
                              • H
                                Harvy66
                                last edited by

                                So same issue as before, firewall is the weakest link, not the bandwidth? Maybe 2.3.

                                Any news from the FreeBSD side of things?

                                1 Reply Last reply Reply Quote 0
                                • S
                                  Supermule Banned
                                  last edited by

                                  Not yet. They are digesting the attack that I did yesterday and curretnly looking at states not beeing freed as they should…. AFAIK.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    torontob
                                    last edited by

                                    Did this end up in nowhere with the issue still being there?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Supermule Banned
                                      last edited by

                                      Still working on it.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        Supermule Banned
                                        last edited by

                                        https://lists.freebsd.org/pipermail/freebsd-announce/2015-July/001655.html

                                        Latest update.

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          peterclark4
                                          last edited by

                                          @Supermule:

                                          https://lists.freebsd.org/pipermail/freebsd-announce/2015-July/001655.html

                                          Latest update.

                                          Does this need to be included in 2.2.4 before it is released?

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            Supermule Banned
                                            last edited by

                                            That would be a very good idea if possible!

                                            Opnsense has this fix done allready and a full release on friday.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post