service iptables stop; hangs constantly on red hat 8

service iptables stop; hangs constantly on red hat 8

[lartc]

hi all,

i have an up2date redhat 8 installation with iptables-1.2.8-8.80.2

as required by my setup, i insmod ip_conntrack_ftp and ip_nat_ftp to
handle connection tracking of ftp sessions.

if a connection has been established, and it becomes closed, or if there
is a current ftp session, "service iptables stop" hangs the machine
while trying to remove modules. here's an example, but it does not
necessairly hang on this module --


[root@aztec root]# ps -eaf | grep mod
root      1728  1672 99 14:39 pts/0    00:01:07 modprobe -r ip_nat_ftp
root      1952  1910  0 14:40 pts/1    00:00:00 grep mod

i have the belief that it is comming from ip_conntrack. in any case, i
can make it happen always (i.e. the system hang). processor time goes to
99% and a reboot is necessary.

has anyone else come accross this? is there something to be flushed
prior to removing the modules?

many thanks!

charles

RE: service iptables stop; hangs constantly on red hat 8

[lartc]

hi george,

yes -- i too recompiled iptables from the .src.rpm and did a rpm -Uvh
--force and acheive the same results on two different machines.

i'll recompile the kernel and try that as well.

thanks!

charles


On Mon, 2003-10-27 at 22:24, George Vieira wrote:
> that is very weird. I would use the latest kernel sources and latest iptables (source not rpm) and recompile the lot. I'm sure it'll then work as I'm running the same verion but not RPMS..
> 
> Thanks,
> ____________________________________________
> George Vieira
> Systems Manager
> georgev@citadelcomputer.com.au
> 
> Citadel Computer Systems Pty Ltd
> http://www.citadelcomputer.com.au
> 
> Phone   : +61 2 9955 2644
> HelpDesk: +61 2 9955 2698
>  
> 
> > -----Original Message-----
> > From: lartc@manchotnetworks.net [mailto:lartc@manchotnetworks.net]
> > Sent: Tuesday, 28 October 2003 12:49 AM
> > To: netfilter-users
> > Subject: service iptables stop; hangs constantly on red hat 8
> > 
> > 
> > hi all,
> > 
> > i have an up2date redhat 8 installation with iptables-1.2.8-8.80.2
> > 
> > as required by my setup, i insmod ip_conntrack_ftp and ip_nat_ftp to
> > handle connection tracking of ftp sessions.
> > 
> > if a connection has been established, and it becomes closed, 
> > or if there
> > is a current ftp session, "service iptables stop" hangs the machine
> > while trying to remove modules. here's an example, but it does not
> > necessairly hang on this module --
> > 
> > 
> > [root@aztec root]# ps -eaf | grep mod
> > root      1728  1672 99 14:39 pts/0    00:01:07 modprobe -r ip_nat_ftp
> > root      1952  1910  0 14:40 pts/1    00:00:00 grep mod
> > 
> > i have the belief that it is comming from ip_conntrack. in any case, i
> > can make it happen always (i.e. the system hang). processor 
> > time goes to
> > 99% and a reboot is necessary.
> > 
> > has anyone else come accross this? is there something to be flushed
> > prior to removing the modules?
> > 
> > many thanks!
> > 
> > charles
> > 
> > 
> > 
> > 

Re: service iptables stop; hangs constantly on red hat 8

[Ted Kaczmarek]

strace service iptables stop

Ted
On Mon, 2003-10-27 at 08:48, lartc@manchotnetworks.net wrote:
> hi all,
> 
> i have an up2date redhat 8 installation with iptables-1.2.8-8.80.2
> 
> as required by my setup, i insmod ip_conntrack_ftp and ip_nat_ftp to
> handle connection tracking of ftp sessions.
> 
> if a connection has been established, and it becomes closed, or if there
> is a current ftp session, "service iptables stop" hangs the machine
> while trying to remove modules. here's an example, but it does not
> necessairly hang on this module --
> 
> 
> [root@aztec root]# ps -eaf | grep mod
> root      1728  1672 99 14:39 pts/0    00:01:07 modprobe -r ip_nat_ftp
> root      1952  1910  0 14:40 pts/1    00:00:00 grep mod
> 
> i have the belief that it is comming from ip_conntrack. in any case, i
> can make it happen always (i.e. the system hang). processor time goes to
> 99% and a reboot is necessary.
> 
> has anyone else come accross this? is there something to be flushed
> prior to removing the modules?
> 
> many thanks!
> 
> charles
> 
-- 
Ted Kaczmarek<tedkaz@optonline.net>
18 Packanack Lake Road
Wayne, NJ, 07470
973-633-6892

AIM-tedhurrah
Yahoo-oasysted