Re: remote crash possibility of FW-1?

[Darren Reed <darrenr () reed wattle id au>]

In some email I received from Thomas Nau, sie wrote:
> Hi there.
> We use Checkpoints Firewall-I release 4.0 SP 4 running on a SUN U2/200
> Solaris 2.6 with up-to-date patchlevel. For several weeks now the box
> crashes or reboots without any hint left in the logfiles. SUN service
> replaced all components (FDDI, RAM, CPUs, ...) except for the mirrored
> disks. Since most of the crashes happen during the weekend we also suspect
> some DOS attack. Are there any known DOS attacks than leave the box
> unusable till someone does a power-off-on cycle?

I find it hard to believe that you've got no evidence about the cause of
the problems.  If you're getting watchdog resets, or similar, you still
get a message in the /var/adm/messages file (dmesg output) at the next
boot about shit that happened (things like memory errors are like this
and don't produce crash dumps).  You've tried the regular methods for
forcing the kernel to give you back an "ok" prompt ?  (going further
than just doing L1-A)

Darren