Yesterday we had an interesting experience with the famous "Winsock error: 997" error:
I was configuring the Nagios server so it was unavailable for a while.
One of the Nagios Eventlog clients wanted to report an error which was caught by it's filter.
Because the Nagios server was temporary unavailable the client produced the "Winsock error: 997" in the error log.
This started a loop, because the client wanted to report this error also, couldn't reach the server, generated an error etc. etc. etc.
The result of it all was that the client started an unintended DOS attack to the Nagios server flooding it with several events per second.
After this other client (which couldn't reach the Nagios server also anymore) started to flood also which at the end resulted in a Nagios server that couldn't perform it checks anymore because it was to buys processing al the incoming events.
My question is: is there anything we can do to prevent these Winsock events from happening?
Thanks!
Grz. JohanStatistics: Posted by jbarelds — Wed Jan 04, 2006 10:29 pm
]]>