Re: Issue with kernel 5.10.0-9-*?
On Sat 30 Oct 2021 at 15:30:53 (+0200), Hans wrote: > Am Montag, 11. Oktober 2021, 10:59:39 CEST schrieb Hans: > So I am answering myself. > > Yesterday I got a new display and could reanimate my notebook. Thus I did > some > testing, and yes, the issue with 5.10.0-9-* is still existent. Going back to > 0-8- let this issue disappear. > > But I got new informations: The kernel module which is responsible for that, > is ath5k.ko (This is an Atheros card). Normally the wireless LED only blinks, > when there is real traffic aimed to my IP. However, with 0-9- the LED is > permanently blinking. > > I could verify, that it is no traffic created by the notebook itself (used > tcpdump) and killed all network processes (daemons/apps whatever) running on > the system. > > But even when there were no processes running except the one needed for the > connection with the router, the LED kept on blinking. > > Further investigation showed, that the blinking appeared due to the broadcast > packages sent by the router. The wireless card thinks, this is normal traffic > and the LED blinks. > > This is bad for me, as the LED was in the past often a good sign, when > soemthing fishy is going on. If the LED is only blinking from time to time, > everything is ok, but when it was blinking som,ething special is going on > (i.e. an update is running or freshclam is updating, but also some brute > force > attacks could also be discovered.) > > So, I would like the old behaviour back! Maybe this could be reverted? Should > I file a bugreport? Or maybe is this already known? > > Maybe someone could confirm this, too, or might have been not noticed yet, > and > could have an eye on his system. Would be nice, before I file a bugreport. > > I also saw, there is kernel-5.14*-bpo* (I believe bpo stands for > "backported"?), did not test this kernel, but if 5.14 will become stable, > this > issue might be already fixed in this version. Dunno > > Thank you very much for reading this and any hints. Is this the same problem that you reported at: https://lists.debian.org/debian-user/2016/06/msg00698.html What did you discover back then? Cheers, David.
Re: Issue with kernel 5.10.0-9-*?
On 10/30/21 16:30, Hans wrote: > I also saw, there is kernel-5.14*-bpo* (I believe bpo stands for > "backported"?), did not test this kernel, but if 5.14 will become stable, > this > issue might be already fixed in this version. Dunno > Hi Hans! bpo means backports. Linux 5.14 is stable now and some distributions use it - Fedora, Arch and probably other too. I'm not sure where it'll be better you to report this issue - on Debian bug tracking system or upstream - https://bugzilla.kernel.org/ Kind regards Georgi
Re: Issue with kernel 5.10.0-9-*?
Am Montag, 11. Oktober 2021, 10:59:39 CEST schrieb Hans: So I am answering myself. Yesterday I got a new display and could reanimate my notebook. Thus I did some testing, and yes, the issue with 5.10.0-9-* is still existent. Going back to 0-8- let this issue disappear. But I got new informations: The kernel module which is responsible for that, is ath5k.ko (This is an Atheros card). Normally the wireless LED only blinks, when there is real traffic aimed to my IP. However, with 0-9- the LED is permanently blinking. I could verify, that it is no traffic created by the notebook itself (used tcpdump) and killed all network processes (daemons/apps whatever) running on the system. But even when there were no processes running except the one needed for the connection with the router, the LED kept on blinking. Further investigation showed, that the blinking appeared due to the broadcast packages sent by the router. The wireless card thinks, this is normal traffic and the LED blinks. This is bad for me, as the LED was in the past often a good sign, when soemthing fishy is going on. If the LED is only blinking from time to time, everything is ok, but when it was blinking som,ething special is going on (i.e. an update is running or freshclam is updating, but also some brute force attacks could also be discovered.) So, I would like the old behaviour back! Maybe this could be reverted? Should I file a bugreport? Or maybe is this already known? Maybe someone could confirm this, too, or might have been not noticed yet, and could have an eye on his system. Would be nice, before I file a bugreport. I also saw, there is kernel-5.14*-bpo* (I believe bpo stands for "backported"?), did not test this kernel, but if 5.14 will become stable, this issue might be already fixed in this version. Dunno Thank you very much for reading this and any hints. Best regards Hans > Am Montag, 11. Oktober 2021, 10:44:27 CEST schrieb Andrei POPESCU: > > I tried to stop ntp and others, no success. I made a pcap file of the > traffic and saved the syslog. > > However, no success, whatever I did. > > Sadly that special notebook died yesterday (backlight of the display died), > and as long I got no spare part, I have to use another laptop with other > hardware (now it is a Amilo AH538 with Intel hardware). Did not test the new > kernel on this one. > > Best > > Hans >
Re: Issue with kernel 5.10.0-9-*?
Am Montag, 11. Oktober 2021, 10:44:27 CEST schrieb Andrei POPESCU: I tried to stop ntp and others, no success. I made a pcap file of the traffic and saved the syslog. However, no success, whatever I did. Sadly that special notebook died yesterday (backlight of the display died), and as long I got no spare part, I have to use another laptop with other hardware (now it is a Amilo AH538 with Intel hardware). Did not test the new kernel on this one. Best Hans > Even if only you are seeing it, it can still be a bug in some software, > that might be worth fixing. Generating excessive network traffic could > lead to e.g. DoS attacks. > > Does the traffic disappear if you stop the ntp service? Has the ntp > package been updated at the same time? Do you get the same with other > NTP software? > > (just standard troubleshooting suggestions) > > Kind regards, > Andrei signature.asc Description: This is a digitally signed message part.
Re: Issue with kernel 5.10.0-9-*?
On Lu, 11 oct 21, 10:38:28, Hans wrote: > Hi Andrei, > It is the package "ntp". > > Please note, that the main goal for my first email was, to make sure, that it > is really a bug and not a problem with my old "krude" hardware combination. > > If only I have this issue, it is ok. If most people got this issue, not good. > And maybe many people even did not notice this issue. As I said, I just > discoverd this by chance. Even if only you are seeing it, it can still be a bug in some software, that might be worth fixing. Generating excessive network traffic could lead to e.g. DoS attacks. Does the traffic disappear if you stop the ntp service? Has the ntp package been updated at the same time? Do you get the same with other NTP software? (just standard troubleshooting suggestions) Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser signature.asc Description: PGP signature
Re: Issue with kernel 5.10.0-9-*?
Hi Andrei, It is the package "ntp". Please note, that the main goal for my first email was, to make sure, that it is really a bug and not a problem with my old "krude" hardware combination. If only I have this issue, it is ok. If most people got this issue, not good. And maybe many people even did not notice this issue. As I said, I just discoverd this by chance. Best regards Hans > What ntp-related software are you using? > > Kind regards, > Andrei signature.asc Description: This is a digitally signed message part.
Re: Issue with kernel 5.10.0-9-*?
On Sb, 09 oct 21, 22:00:06, Hans wrote: > Dear list, > > it would be nice, if you could check something and maybe confirm or deny it. > > My system is debian/stable. > As now the new kernel version is released, which is 5.10.0-9-amd64, I updated > from 0-8-amd64 to 0-9-amd64. > > But, with this kernel I discovered, that the network traffic massively > increased. I am not sure, what is causing this. Examining with wiresharḱ and > also the syslog file, it looks like it has something to do with ntp. Also the > broadcast messages are more than normal. What ntp-related software are you using? Kind regards, Andrei -- http://wiki.debian.org/FAQsFromDebianUser signature.asc Description: PGP signature
Re: Issue with kernel 5.10.0-9-*?
Hi. On Sat, Oct 09, 2021 at 10:00:06PM +0200, Hans wrote: > My system is debian/stable. > As now the new kernel version is released, which is 5.10.0-9-amd64, I updated > from 0-8-amd64 to 0-9-amd64. > > But, with this kernel I discovered, that the network traffic massively > increased. I am not sure, what is causing this. Examining with wiresharḱ and > also the syslog file, it looks like it has something to do with ntp. Also the > broadcast messages are more than normal. I cannot confirm your observations. I have a small (<10 hosts) LAN all running Debian stable. NTP is used for time synchronization. Just like you, I've upgraded yesterday, and hosts are running kernel version 5.10.0-9 (only one of them runs amd64 though). I see nothing unusual in both tcpdump and ulogd2 (I use it for the traffic accounting). Specifically, there's nothing unusual in NTP packets, be it their size or quantity. Reco
Issue with kernel 5.10.0-9-*?
Dear list, it would be nice, if you could check something and maybe confirm or deny it. My system is debian/stable. As now the new kernel version is released, which is 5.10.0-9-amd64, I updated from 0-8-amd64 to 0-9-amd64. But, with this kernel I discovered, that the network traffic massively increased. I am not sure, what is causing this. Examining with wiresharḱ and also the syslog file, it looks like it has something to do with ntp. Also the broadcast messages are more than normal. As I said, I am not sure, what is going on, and can also not confirm, if it is an unlucky hardware of my system (amd-cpu, Nvidia graphics card and Atheros wireless card), or a kernel issue. With kernel 5.10.0-8-amd64 everything is ok. It was just by chance that I discovered this, because my network state led for the wireless card is only blinking, when there is traffic. In normal it is mostly dark, but with the latest kernel it is permanently flashing, telling, there is a lot of traffic. Before I file a bugreport, I hope, this could be confirmed by others. Thank you for reading this. Best regards Hans P.S. At the moment I am still with the old kernel, as I do not know, which data are send from my system (I wanna be secure!) signature.asc Description: This is a digitally signed message part.
