On Tue, 28 Apr 2015, Christos Zoulas wrote:
Looks like that qsort is deadly... I wonder why it thinks it needs to sort something all the time. The arp stuff looks suspect as expected. (if it is related to ndp). I am not sure if I have time to optimize the code, but using a hashmap instead of sorting seems to be a good thing to do.
Yet another information. In normal operation 'ndp -an | wc -l' reports nearly 1500 entries.
During the attack ndp reports: ndp: ioctl(SIOCGNBRINFO_IN6): Invalid argument ndp: failed to get neighbor information ndp: ioctl(SIOCGNBRINFO_IN6): Invalid argument ndp: failed to get neighbor information ... Could that be a problem for the snmpd? Regards Uwe