Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How My Printer Caused Excessive Syscalls and UDP Traffic

zinascii.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#11

Post by bensummers »

userbinator wrote: post #2

Is mDNS really so useful? Of all the people I know who know about it, everyone has disabled it when possible due to all the useless network traffic it produces. Apparently Canon's wireless printers are well known for doing mDNS floods: http://digitalhome.ca/forum/showthread.php?t=148153 http://forums.anandtech.com/archive/index.php/t-2171044.html

I find mDNS very useful for our development VMs: http://bens.me.uk/2013/multicast-dns-and-development-virtual...

Instead of hacking your /etc/hosts file, just let the VM publish relevant DNS entries using mDNS.

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#12

Post by cesarb »

At least all he had was excessive syscalls.

At work, we had a problem where a computer was spamming the network with DHCP requests. It ended up physically locking us out; the embedded system which controls the card reader and unlocks the door locked up due to the load. I had to use an alternative way to get in, isolated the maglock, and later power-cycled the embedded system.

Needless to say, we enabled storm control on the switch after that.

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#13

Post by tjohns »

cesarb wrote: post #12

At least all he had was excessive syscalls. At work, we had a problem where a computer was spamming the network with DHCP requests. It ended up physically locking us out; the embedded system which controls the card reader and unlocks the door locked up due to the load. I had to use an alternative way to get in, isolated the maglock, and later power-cycled the embedded system. Needless to say, we enabled storm control…

You might want to put your security system and other infrastructure hardware on a separate VLAN.

Not only does that help prevent stuff like this, it turns out that a lot of embedded hardware isn't that great from a network security perspective.

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#14

Post by cesarb »

tjohns wrote: post #13
cesarb wrote: post #12

At least all he had was excessive syscalls. At work, we had a problem where a computer was spamming the network with DHCP requests. It ended up physically locking us out; the embedded system which controls the card reader and unlocks the door locked up due to the load. I had to use an alternative way to get in, isolated the maglock, and later power-cycled the embedded system. Needless to say, we enabled storm control…

You might want to put your security system and other infrastructure hardware on a separate VLAN. Not only does that help prevent stuff like this, it turns out that a lot of embedded hardware isn't that great from a network security perspective.

We didn't even have VLANs enabled on the switch back then.

And even then, the storm control is useful; the same broadcast storm also made the office wireless unusable (most APs use a basic rate for broadcast and multicast).

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#15

Post by glitch »

kawouli wrote: post #10
glitch wrote: post #7

Earlier quoted context omitted.

For a simple DNS-SD setup on unicast DNS, yes, it's basically a combination of PTR and TXT records. See http://www.dns-sd.org/serversetup.html for more information. For example, in one network, multicast was completely disabled — no mDNS happening there — and so on our local (unicast) DNS server (BIND on a 'BSD), we added DNS-SD entries (PTR + TXT records) for printers (to a CUPS print server with Active Directory au…

A service instance is a combination of an SRV record containing the service hosts name and port and a TXT record containing meta-information (key=value pairs). Services instances are found via PTR records. For HTTP services in a browse domain called example.com, you'd query for _http._tcp.example.com PTR records and get back a list of instance names such as HN._http._tcp.example.com. If you then wanted to connect to…

Yep! I forgot to mention the SRV records for some odd reason.

Re: How My Printer Caused Excessive Syscalls and UDP Traffic

#17

Post by rzezeski »

rasz_pl wrote: post #16

What were teh effects? How did the author notice? Was his server lagging? his OSX machine? If would be pretty awesome if you could dos MACs with 250KB/s flood.

That's a good question. I should have mentioned that in the post perhaps. The reason I initially ran vmstat was just to make sure my dev machine was "zeroed out". Recently my kernel builds had taken twice the time as normal and I wasn't sure why. That's when I noticed this. It turns out this had no significant effect on my build times but was rather an effect of a different change I made weeks prior. I also noticed no ill effects on my laptop that I recall.
Post reply on HN