Post #3579850

so i look into why my logs are so enormous. i shouldn’t have left them as verbose for 1.5 months but they also shouldn’t have grown to EIGHT GIGABYTES. and most of my recent log lines are something like Jul 04 13:36:22 msg="Limit of simultaneous TCP connections reached - raise max-tcp-connections" prio="Warning" this, but 15 times a second… Which usually means that we’re under attack. but it’s a very lousy attack, i can’t even see it on the graph, so they’re only really causing some disruption to TCP connections, not UDP. and most of DNS is UDP, that’s why I’m only noticing right now. anyways. ss -tulnap | grep 53 shows a lot of connections with addresses that begin with 2a03:2880. | wc -l says 273, from maybe 5-6 different hosts. and, my dear comrades, can you guess who owns 2a03:2880::/32? inet6num: 2a03:2880::/40 netname: PRN country: US admin-c: RD4299-RIPE tech-c: RD4299-RIPE status: ASSIGNED mnt-by: fb-neteng mnt-by: facebook-neteng created: 2020-03-11T00:33:38Z last-modified: 2020-03-11T00:33:38Z source: RIPE that’s right! facebook! and after a preliminary check, we’ve seen this same exact thing on at least one other #SERVFAIL nameserver in “completely unrelated news”: i “slipped” in my kitchen and executed ip6tables -I INPUT -s 2a03:2880::/32 -j DROP as root on sakamoto i’m so sorry (not sorry). and through the power of ip6tables… suddenly my TCP limits aren’t reached anymore. CURIOUS if you didn’t have enough reasons to hate meta: FUCK META :boost_ok: