<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>Occasionally ipsec causes the machine to lock up and a
reboot is the only option. It works fine for connections, for the most part
this behavior happened from restarting the ipsec service. But, recently someone
attempted to vpn in, a hacker by the looks of things, not someone with a
valid certificate. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Seems to have caused the following..<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] Modules
linked in: tcp_diag inet_diag xfrm4_mode_tunnel ppp_deflate bsd_comp ppp_async
crc_ccitt authenc xfrm<o:p></o:p></p>
<p class=MsoNormal>4_mode_transport pppoe pppox ppp_generic slhc act_police
sch_ingress sch_sfq sch_cbq cls_u32 sch_htb ipt_REJECT xt_state xt_limit
xt_mark iptable_filter ipt_<o:p></o:p></p>
<p class=MsoNormal>LOG iptable_nat xt_tcpudp xt_MARK iptable_mangle ip_tables
x_tables tun xfrm_user xfrm4_tunnel tunnel4 ipcomp esp4 aead ah4 ipv6 deflate
zlib_deflate zlib_in<o:p></o:p></p>
<p class=MsoNormal>flate ctr twofish twofish_common camellia serpent blowfish
des_generic cbc aes_i586 aes_generic xcbc sha256_generic sha1_generic
crypto_null crypto_blkcipher<o:p></o:p></p>
<p class=MsoNormal> af_key ext2 reiserfs dm_snapshot dm_mirror dm_log
dm_mod nf_nat_ftp nf_nat nf_conntrack_ipv4 nf_conntrack_ftp nf_conntrack 8021q
ide_disk video output psmou<o:p></o:p></p>
<p class=MsoNormal>se snd_pcsp snd_pcm snd_timer snd soundcore snd_page_alloc
serio_raw button rng_core iTCO_wdt e752x_edac edac_core shpchp pci_hotplug
dcdbas evdev ext3 jbd m<o:p></o:p></p>
<p class=MsoNormal>bcache sg sd_mod ide_cd_mod cdrom ata_generic libata dock
piix floppy ide_pci_generi<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: ide_core megaraid_mbox
scsi_mod megaraid_mm ehci_hcd e1000 uhci_hcd usbcore thermal processor fan
thermal_sys<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] Pid: 4917,
comm: pluto Tainted: G W
(2.6.26-1-686 #1)<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] EIP:
0060:[ipv6:_spin_lock+0x10/0x15] EFLAGS: 00000202 CPU: 2<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] EIP is at
_spin_lock+0x10/0x15<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] EAX:
f2279d2c EBX: f2279d2c ECX: 000001e0 EDX: 00007576<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] ESI:
f2279d00 EDI: f2cf0680 EBP: 00000001 ESP: f7d2fd28<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] DS:
007b ES: 007b FS: 00d8 GS: 0033 SS: 0068<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] CR0:
8005003b CR2: b768a000 CR3: 34cdc000 CR4: 000006d0<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] DR0:
00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987] DR6:
ffff0ff0 DR7: 00000400<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[udp_queue_rcv_skb+0xd1/0x229] ? udp_queue_rcv_skb+0xd1/0x229<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[ipv6:release_sock+0x3a/0x85] ? release_sock+0x3a/0x85<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[udp_recvmsg+0x1c9/0x233] ? udp_recvmsg+0x1c9/0x233<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[ipv6:sock_common_recvmsg+0x2f/0x45] ? sock_common_recvmsg+0x2f/0x45<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sock_recvmsg+0xde/0xf9] ? sock_recvmsg+0xde/0xf9<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[<c011b61d>] ? default_wake_function+0x0/0x8<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[<c013177c>] ? autoremove_wake_function+0x0/0x2d<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[<c011b61d>] ? default_wake_function+0x0/0x8<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sys_recvmsg+0x117/0x1c8] ? sys_recvmsg+0x117/0x1c8<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sys_sendto+0xfc/0x127] ? sys_sendto+0xfc/0x127<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[move_addr_to_user+0x50/0x68] ? move_addr_to_user+0x50/0x68<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sys_getsockname+0x76/0xa1] ? sys_getsockname+0x76/0xa1<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sys_socketcall+0x190/0x19e] ? sys_socketcall+0x190/0x19e<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sys_poll+0x3b/0x6e] ? sys_poll+0x3b/0x6e<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[sysenter_past_esp+0x78/0xb1] ? sysenter_past_esp+0x78/0xb1<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
[virtcons_probe+0xd6/0xdd] ? virtcons_probe+0xd6/0xdd<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:05 imryrr kernel: [1463985.774987]
=======================<o:p></o:p></p>
<p class=MsoNormal>May 14 12:29:07 imryrr kernel: [1463987.408107] NETDEV
WATCHDOG: eth0: transmit timed out<o:p></o:p></p>
</div>
</body>
</html>