Re: DoS by small packets: eth0: Too much work at interrupt, IntrStatus=0x0001.

[Stephen Smoogen <smoogen lanl gov>]

On Thu, 2004-07-08 at 04:51, Milan Keršláger wrote:
> Hi,
> 
> I have a trouble with DoS attacks to one internal machine through RHEL3
> router. It seems that a lot of small packets causing DoS (100Mbps links)
> on my router even I shut down my firewall rules.
> 

Ok need more info as I am confused.

1) What is the router? Is it the RHEL box? {CPU, MB, PCI speed, etc}
2) What is the DOS? Is it the machine on the network hitting the router
or things on the internet trying to get to the networked machine
3) Is the UTP 10baseT or 100baseT

In either case, I have seen that the best bet is to upgrade the network
card to a more server oriented one (the RTL8139C is not a high traffic
card.. and is known to cause this problem). I have found that the latest
Intel E100 cards seem to handle traffic much better now (if you have to
use old eqt.. avoid any Intel made before 2002.) 

Second you might need to upgrade the motherboard if the better network
card still has this issue. If the motherboard is only a 33->66 Mhz bus
and you are trying to push too much through it.. I have seen the error
you are reporting. I have also seen it with certain VIA chipsets where
the bus says it can handle a lot.. but not really.

> The machine has two RTL8139C cards. I tryed 3C905 cards with no luck.
> Just after plugging UTP cable into the machine the system slow down and
> freeze until UTP has been unplugged.
> 
> Is there a chance to avoid this problem? Is it know bug?
> 
> I see a lot of lines with this error message in dmesg output:
> 
> eth0: Too much work at interrupt, IntrStatus=0x0001.
-- 
Stephen John Smoogen		smoogen lanl gov
Los Alamos National Lab  CCN-5 Sched 5/40  PH: 4-0645
Ta-03 SM-1498 MailStop B255 DP 10S  Los Alamos, NM 87545
-- Please, I have had too much of the stupid today. Please wait until
-- tomorrow to say these things so my tolerance has refreshed.