[Mimedefang] Can someone explain this?

[David F. Skoll]

On Wed, 26 Nov 2003, Jon R. Kibler wrote:

> We ran into a new problem overnight. Some clown tried a dictionary
> attack against one of our customer's domains. After about 4 tries to
> spam our customer, MD suddenly started gagging (see log
> below). However, after about a minute, everything seemed to correct
> itself. Checking our performance monitoring logs, our load level never
> exceeded 3, cpu utilization never exceeded 8%, we had zero paging and
> disk i/o was less than 10/sec.

What happened was a whole whack of requests came in at around the same time
(notice the time stamp in your logs!) and the listen(2) backlog of the
multiplexor's listening socket was exceeded, so it started rejecting
connections.

After a little while, things settled back to normal.

Regards,

David.