iptables causing 100% cpu load

[coolsaggu]

Hi All,

I am quite new to GoAutoDial installations.

I recently installed a version of GoAutoDial 2.0 on a Intel Dual Core Machine with 4GB RAM.

The problem that I am facing is that after around 4 hours of dialing the System Information reports 100% Load Average and due to this my internet bandwidth gets choked completely.

I tried using the top command to see which process is causing 100% load and i get .iptables as the top entry.

I am unable to understand why .iptables is causing so much load on cpu.

Also, I would like to mention that if i plug out the Ethernet cable from the server, the bandwidth is freed and everything is normal.

Any help to solve this problem will be appreciated.

Thanks

[geoff3dmg]

If you use 'iftop -P' you can see where the actual bandwidth is being used (ip/ports). Then once you have the local port you can use 'netstat -apn' to identify the process involved.

[coolsaggu]

Thanks buddy, for sending me the reply. I will perform the test soon.

Thanks for all the help.

[williamconley]

Hi All,

I am quite new to GoAutoDial installations.

I recently installed a version of GoAutoDial 2.0 on a Intel Dual Core Machine with 4GB RAM.

The problem that I am facing is that after around 4 hours of dialing the System Information reports 100% Load Average and due to this my internet bandwidth gets choked completely.

I tried using the top command to see which process is causing 100% load and i get .iptables as the top entry.

I am unable to understand why .iptables is causing so much load on cpu.

Also, I would like to mention that if i plug out the Ethernet cable from the server, the bandwidth is freed and everything is normal.

Any help to solve this problem will be appreciated.

Thanks

Please always post your Vicidial version with build. It's a requirement for posting on this forum.

If you are under attack (brute force login attack, etc), you can experience this exact scenario. Even if iptables is rejecting packets from the attacker (after fail2ban locks them out), the packets are still arriving, using bandwidth, and using cpu cycles to reject them. This results in a denial of service condition (aka: DOS attack). If you install with Vicibox instead of Goautodial, our "Dynamic Good Guys" package on Viciwiki.com will show you how to lock down your system. It's not required, though, it's just a suggestion. The ultimate goal is to whitelist lock your system: No one should be able to detect your system exists unless they are in your whitelist. This is fairly easy to accomplish with iptables (and beats fail2ban hands down).

I believe we posted an iptables config example on this site a while back that will work as a "manual whitelist" system. Google it and you may find it (works equally well in CentOS, Ubuntu, Gentoo and OpenSuSE ... but was originally designed for OpenSuSE in Vicibox).

[geoff3dmg]

I believe we posted an iptables config example on this site a while back that will work as a "manual whitelist" system. Google it and you may find it (works equally well in CentOS, Ubuntu, Gentoo and OpenSuSE ... but was originally designed for OpenSuSE in Vicibox).

I believe you are referring to this post?

viewtopic.php?p=88105#p88105

[williamconley]

LOL: as a matter of fact I am. I made a couple quick edits on it as well. Apparently some people were leaving port 22 open forever instead of closing them after testing ... so I changed it to closed and made a note to open it temporarily for testing, plus closing a couple ICMP ports instead of rejecting.