Re: [Micronet] any other half-dead servers lately?

(read from top to bottom...)

On Aug 11, 2006, at 10:00 AM, Greg Merritt wrote:

>
> I have a machine running OS X Server v. 10.4.7. On Tuesday,
> Wednesday, Thursday, and again today -- but not even close to the
> same time -- the machine crashed.
>
> Except, not really. I could ping it. Ok... but I could also
> telnet to a service port (25, 80...) and instantly get a socket
> connection... but the service would not "talk" to me after initial
> connections. (I could even walk up to the machine and move the
> mouse and finder&app windows around, but trying to *do* anything in
> any app would cause the app to freeze w/ the spinning colorful ball.)
>
> Meanwhile, I found that a colleague across campus (actually, at the
> Richmond Field Station) saw THE SAME THING happen to a somewhat
> older Dell RedHat machine on Wednesday and Thursday. He could
> telnet to a socket and get an instant, successful connection, but
> no responses after initial connections.
>
> We're each going through the usual drill to diagnose, but I thought
> I'd send a quick post out across campus on the odd chance that this
> same thing is happening to other machines.
>
> (We each have other machines configured similarly, but they have
> NOT gone into the semi-frozen condition like these two.)
>
> So, if you have any servers that have gone in to a similar semi-
> frozen state in the last couple of days, please drop me a line.
>
> Thanks,
> -Greg

Well, I can add a third machine to this list -- an Xserve running
10.3.9. Pingable, can open sockets... but no services "talk" once a
socket is open. All three of the machines are in different buildings
on completely different subnets.

I don't want to jump to conclusions, but there may be some
correlation with SNS scans when these half-dead lockups are
happening. Then again, maybe there is just a LOT of SNS scanning all
the time, and no actual correlation. ;)

If anybody else has recently seen or soon sees a machine partially
lock up like this, please let me know. If you have a machine that
seems to have locked up, please try to ping it and telnet to one of
its services ports to see how it responds. Maybe we're just having a
string of odd luck, but, in the odd chance that this is not the case,
I'd like to find out sooner rather than later.

I've included a little transcript below that shows how the machine
still partially responds when it's actually useless. Names and
numbers removed to protect the innocent.

-Greg

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
traffic:~ gregm$ ping 128.32.xxx.xxx
PING 128.32.xxx.xxx (128.32.xxx.xxx): 56 data bytes
64 bytes from 128.32.xxx.xxx: icmp_seq=0 ttl=59 time=1.130 ms
64 bytes from 128.32.xxx.xxx: icmp_seq=1 ttl=59 time=0.958 ms
64 bytes from 128.32.xxx.xxx: icmp_seq=2 ttl=59 time=1.094 ms
^C
--- 128.32.xxx.xxx ping statistics ---
3 packets transmitted, 3 packets received, 0% packet loss
round-trip min/avg/max/stddev = 0.958/1.061/1.130/0.074 ms
traffic:~ gregm$ ssh -v bhl@!$
ssh -v bhl@128.32.xxx.xxx
OpenSSH_3.8.1p1, OpenSSL 0.9.7i 14 Oct 2005
debug1: Reading configuration data /etc/ssh_config
debug1: Connecting to 128.32.xxx.xxx [128.32.xxx.xxx] port 22.
debug1: Connection established.
debug1: identity file /Users/gregm/.ssh/identity type -1
debug1: identity file /Users/gregm/.ssh/id_rsa type -1
debug1: identity file /Users/gregm/.ssh/id_dsa type 2
^C
traffic:~ gregm$ grep ssh /etc/services
ssh 22/udp # SSH Remote Login Protocol
ssh 22/tcp # SSH Remote Login Protocol
sshell 614/udp # SSLshell
sshell 614/tcp # SSLshell
# Kazuhito Gassho
<Gassho.Kasuhito@exc.epson.co.jp>
traffic:~ gregm$ telnet 128.32.xxx.xxx 22
Trying 128.32.xxx.xxx...
Connected to xxx.xxx.berkeley.edu.
Escape character is '^]'.

asdf
asdf
asdf
asdf
^C
^]
telnet> quit
Connection closed.
traffic:~ gregm$ grep mysql /etc/services
mysql 3306/udp # MySQL
mysql 3306/tcp # MySQL
traffic:~ gregm$ telnet 128.32.xxx.xxx 3306
Trying 128.32.xxx.xxx...
Connected to xxx.xxx.berkeley.edu.
Escape character is '^]'.
'
4.0.24H?Hjb-WQnVF,

Bad handshakeConnection closed by foreign host.
traffic:~ gregm$ asdf
-bash: asdf: command not found
traffic:~ gregm$
traffic:~ gregm$
traffic:~ gregm$ telnet 128.32.xxx.xxx 5900
Trying 128.32.xxx.xxx...
Connected to xxx.xxx.berkeley.edu.
Escape character is '^]'.
asdfsadf

asdf^C
^C^]
telnet> quit
Connection closed.
traffic:~ gregm$

------------------------------------------------------------------------
The following was automatically added to this message by the list server:

For information about MAGNet, its meetings and events, and its
mailing list, including information on subscribing and unsubscribing,
see the MAGNet Web site at <http://magnet.berkeley.edu/>.
Received on Mon Aug 14 16:20:15 2006