*BSD News Article 93881


Return to BSD News archive

Path: euryale.cc.adfa.oz.au!newshost.carno.net.au!harbinger.cc.monash.edu.au!news.cs.su.oz.au!metro!metro!munnari.OZ.AU!news.ecn.uoknor.edu!feed1.news.erols.com!howland.erols.net!news2.digex.net!news
From: tomk@access.digex.net (Tom Krotchko)
Newsgroups: comp.security.firewalls,comp.unix.bsd.bsdi.misc
Subject: Gauntlet/BSD "transitions" every hour
Date: 18 Apr 1997 21:07:59 GMT
Organization: Comm Systems, Inc.
Lines: 35
Message-ID: <5j8nrf$5dh@news4.digex.net>
NNTP-Posting-Host: commsystems.digex.net
Mime-Version: 1.0
Content-Type: Text/Plain; charset=US-ASCII
X-Newsreader: WinVN 0.99.9 (Beta 3) (x86 32bit)
Xref: euryale.cc.adfa.oz.au comp.security.firewalls:7350 comp.unix.bsd.bsdi.misc:6668


I've got a TIS Gauntlet v3.2 installed on an Intel/BSDI system.  It uses token ring
cards (although I'm not sure that's relevant).  Its a pentium with 16M of RAM.

Every hour at about 17 minutes after the hour (EVERY hour, mind you), 
connectivity goes away on this machine.  You can ping it, but you can't
telnet, ftp, or http through it.  At about 21 minutes after the hour, 
connectivity resumes.  Its just like clockwork.

I checked the cron table, and there is nothing there.

Weirder still, I just discovered today while trying to diagnose with
  systat -netstat

That just after the connectivity comes back, I get the message at the bottom
of the display:
   "Kernel In State of Transition"

I have no idea why this is occuring or what this error message means.  But
I think the two events are related.

1) Since this happens so regularly, I've got to believe the kernel is doing 
something that is killing the application portion of IP.  Does something
happen in a stock BSD machine every hour like this?

2) Is this the firewall doing something?

3) What does the "transition" message mean?

Any help would be appreciated.


-- 
Tom Krotchko
<tomk@access.digex.net>