<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=ISO-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2650.12">
<TITLE>RE: TCP session disconnection caused by Code Red? </TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2>I can see "connection refused" being caused by lack of resources (memory, not CPU) caused by ARP requests not being resolved and waiting to time out. </FONT></P>
<P><FONT SIZE=2> What happens is that all the outstanding ARP requests use up all available memory, so no buffers can be allocated for new incoming connections. Send enough requests fast enough, looking for enough different IP's, memory gets exhausted.</FONT></P>
<P><FONT SIZE=2> Been there, seen it happen, tweaked the WellFleet/Bay/Nortel knob to limit the amount of space used for ARP resolution, and solved the problem caused by too many outstanding ARPs. Of course, I could have stuffed in more memory, but limiting the space used for the process was easier.</FONT></P>
<P><FONT SIZE=2>James H. Smith II NNCDS NNCSE</FONT>
<BR><FONT SIZE=2>Systems Engineer</FONT>
<BR><FONT SIZE=2>The Presidio Corporation</FONT>
</P>
<BR>
<P><FONT SIZE=2>-----Original Message-----</FONT>
<BR><FONT SIZE=2>From: George William Herbert [<A HREF="mailto:gherbert@retro.com">mailto:gherbert@retro.com</A>]</FONT>
<BR><FONT SIZE=2>Sent: Monday, August 06, 2001 2:57 PM</FONT>
<BR><FONT SIZE=2>To: mike harrison; nanog@merit.edu</FONT>
<BR><FONT SIZE=2>Subject: Re: TCP session disconnection caused by Code Red? </FONT>
</P>
<BR>
<BR>
<BR>
<BR>
<P><FONT SIZE=2>mike harrison <meuon@highertech.net> wrote</FONT>
<BR><FONT SIZE=2>>Blaz Zupan <blaz@amis.net> wrote:</FONT>
<BR><FONT SIZE=2>>> For the last few days, our network seems to be basically unreachable from the</FONT>
<BR><FONT SIZE=2>>> outside. Most incoming TCP sessions (web requests, incoming mail, telnet</FONT>
<BR><FONT SIZE=2>>> sessions, etc.) often fail with a simple "Connection refused" like nobody is</FONT>
<BR><FONT SIZE=2>></FONT>
<BR><FONT SIZE=2>>Your routers are brain dead from the load.. routers that are used to</FONT>
<BR><FONT SIZE=2>>handling a few thousand connections are being asked to handle 10's of</FONT>
<BR><FONT SIZE=2>>thousands. 1 good 1000+ address scan from an ISDN user kills my</FONT>
<BR><FONT SIZE=2>>Lucent/Ascend TNT unless we filter for it. </FONT>
</P>
<P><FONT SIZE=2>I've been told (but not given permission to forward details of</FONT>
<BR><FONT SIZE=2>who/how/what) that some major sites with a single router</FONT>
<BR><FONT SIZE=2>and relatively flat network topology are dying due to the ARP</FONT>
<BR><FONT SIZE=2>request flood that is being generated by Code Red scans on the</FONT>
<BR><FONT SIZE=2>inside of their border router choking the router. Check the</FONT>
<BR><FONT SIZE=2>rate of ARP requests coming off your border router and see if</FONT>
<BR><FONT SIZE=2>it seems excessive; if so, that may be it.</FONT>
</P>
<BR>
<P><FONT SIZE=2>-george william herbert</FONT>
<BR><FONT SIZE=2>gherbert@retro.com</FONT>
</P>
</BODY>
</HTML>