RE: RE: Socket Accept() error occurred in QHTTP(classicserver)

An email harvester!!  What would be fun is to poison the well for this
particular IP.  Not too long ago, I had that problem with a personal
site being crawled by a harvester.  I created a program to generate
bogus emails.  It will poison the harvester's database and the person
who is using that database for spam will have a few thousand (or more)
bad addresses and have to throw out the list. When that particular IP
address shows up again, they won't get the forum, but a generated bogus
list.


Jeffrey Flaker
Senior Programmer/Analyst
Linens 'N Things
6 Brighton Rd
Clifton, NJ 07015
Phone: 973-249-4384
Fax: 973-249-4901
http://www.lnt.com
"A good player makes himself look good; a great player makes the team
look good."
Author unknown 



-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Bob Cozzi
Sent: Friday, September 09, 2005 9:45 AM
To: 'Web Enabling the AS400 / iSeries'
Subject: RE: [WEB400] RE: Socket Accept() error occurred in
QHTTP(classicserver)

Scott,

What it looks like is that someone from a specific IP address, was going
through our RPG Community Forum messages, one by one, and following
those links to the individual replies and hunting for email addresses. 
So I've done two things. (1) I removed the function/page that allows
users of the forum to specify their email address and therefore the link
to the page that would allow sending directly to those email address.
And (2) I've blocked that IP address. Although I'm sure tomorrow a new
one will be used. 
Thanks for the tips.

-Bob Cozzi
www.RPGxTools.com
RPG xTools - Enjoy programming again.


-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of web400@xxxxxxxxxxxxxxxx
Sent: Thursday, September 08, 2005 2:23 PM
To: Web Enabling the AS400 / iSeries
Subject: Re: [WEB400] RE: Socket Accept() error occurred in QHTTP
(classicserver)


> Is it really though Bob?  If I look at my logs that is the period of 
> time when I get most DOS and other similar hack attacks.  Is it 
> possible that some attempt at a buffer over-run exploit or something
is triggering it?

Sounds more like a SYN flood than a buffer overrun!

To establish a TCP connection, a client computer sends a SYN
(Synchronize) packet to the server. This tells the server that a new
connection is coming, so it sends back a SYN/ACK (Synch Acknowledge)
packet and the
accept() API creates a new socket descriptor for the connection.

A SYN flood is where someone writes a program that generates lots of SYN
packets from fake IP addresses and sends them as fast as possible to a
server.  This causes the server to think that lots of simultaneous
connection attempts are coming in, and it'll open up descriptors and
send back SYN/ACK packets.

Eventually, they time out and the descriptors close, but if you send the
SYN packets fast enough, the server won't be able to recover and will
run out of descriptors.  That's what the "Too many files open" message
means
-- that you've run out of descriptors.

IBM could fix the problem by modifying the TCP/IP stack to be more
careful in uses as few resources as possible until the complete session
is set up, or they could drop SYN packets when they come in faster than
a certain rate, there's lots of different strategies.

More info on SYN flooding can be found here:
http://www.cert.org/advisories/CA-1996-21.html

I don't know for sure that this is what's happening, it's just a guess
on my part.