Great, let us know how it looks over the weekend.
Getting frequent warnings about inbound HTTP traffic rule
After a recent reboot of a server, I am seeing quite frequent warnings from the "Inbount network traffic to HTTP server on unexpected port" rule.
The warning just states the connection (fd.name
) is 0.0.0.0:0 > 0.0.0.0:0
. When adding proc.cmdline
and proc.pcmdline
to the output, it states that both are apache2 k start
.
Is this something others are experiencing as well? Could it be a bug with Falco, or is it something weird going on with my Apache setup?
该提问来源于开源项目：falcosecurity/falco
 点赞
 写回答
 关注问题
 收藏
 复制链接分享
 邀请回答
8条回答

采纳
点赞 评论 复制链接分享

采纳
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
点赞 评论 复制链接分享 
采纳
I enabled the rule
HTTP server unexpected network inbound traffic
from /etc/falco/rules.d/application_rules.yaml (I'm pretty sure that's the one you're using?) and restarted apache a few times without noticing any events.I wonder if you're experiencing dropped system calls, which can result in incomplete state within falco and as a result false positives. Can you try running falco with v? At shutdown, you can look at the
Driver Events:
andDriver Drops:
values. You can also trys <stats file>
to write periodic stats on events received and dropped to a file, and then check the file to see if you have a nonzero drops count.点赞 评论 复制链接分享 
采纳
I enabled the rule
HTTP server unexpected network inbound traffic
from /etc/falco/rules.d/application_rules.yaml (I'm pretty sure that's the one you're using?) and restarted apache a few times without noticing any events.Yes, that is the one.
We have a few other servers used for testing etc. as well, running with the same setup, but this has not been reported from any of them. I would assume it is also connected to the load on the production servers.
I wonder if you're experiencing dropped system calls, which can result in incomplete state within falco and as a result false positives. Can you try running falco with v? At shutdown, you can look at the
Driver Events:
andDriver Drops:
values. You can also trys <stats file>
to write periodic stats on events received and dropped to a file, and then check the file to see if you have a nonzero drops count.That sounds more like it. I can give it a try and fire up Falco with both
v
ands <file>
though and see what it reports :slightly_smiling_face:点赞 评论 复制链接分享 
采纳
Gotten two messages of the kind so far today. The neither output from
v
or the file set withs
reports anything unusual when this occurs.点赞 评论 复制链接分享 
采纳
After running falco with
v s /tmp/falcostats.log
for about 56 days now I can report that the verbosity does not help much, in fact nothing at all.The stats file (
/tmp/falcostats.log
) that is written to I can not really make too much sense out of, but I have found that in the JSON, only the firstsample
property, thecur.events
property anddelte.events
property really change. Thecur.drops
isn't 0 but also does not change (stable at 1174047).cur.events
seems to increment in general as if it was a timestamp,sample
seems to increment per line anddelte.events
seem quite random. Not sure if any of that is of any help at all.I will try and upgrade to 0.13.0 and see if that changes anything.
点赞 评论 复制链接分享 
采纳
Thanks for that info.
cur.drops
is the most important one. It shows on an intervalbyinterval basis how many dropped system calls there were. And if that value is mostly 0 and is 0 when you saw the falco alerts, then dropped system calls is probably not the source of the problem you're seeing.From looking more closely at the inbound macro, I think a better version of it could be the following:
 macro: inbound condition: > (((evt.type in (accept,listen) and evt.dir== 0 or evt.res = EINPROGRESS))
This handles a few additional ways messages could be received (recvfrom,recvmsg) but also explicitly ignores nonblocking accepts in a better way than the old macro.
Do you want to try that version of the
inbound
macro instead? The changes are also in this PR if you'd just like to take the whole rules file: https://github.com/falcosecurity/falco/pull/470.点赞 评论 复制链接分享 
采纳
Applied this last night and so far so good. Usually there are a couple of messages during the morning "rush traffic" on the sites, but nothing so far.
点赞 评论 复制链接分享
相关推荐
 4年前回答 2 已采纳 Problem Description You are given a sequence of n integers a1 , a2 , ... , an in nondecreasing order. In addition to that, you are given several queries consisting of indices i and j (1 ≤ i ≤ j ≤ n). For each query, determine the most frequent value among the integers ai , ... , aj . Input The input consists of several test cases. Each test case starts with a line containing two integers n and q (1 ≤ n, q ≤ 100000). The next line contains n integers a1 , ... , an(100000 ≤ ai ≤ 100000, for each i ∈ {1, ..., n}) separated by spaces. You can assume that for each i ∈ {1, ..., n1}: ai ≤ ai+1. The following q lines contain one query each, consisting of two integers i and j (1 ≤ i ≤ j ≤ n), which indicate the boundary indices for the query. The last test case is followed by a line containing a single 0. Output For each query, print one line with one integer: The number of occurrences of the most frequent value within the given range. Sample Input 10 3 1 1 1 1 1 1 3 10 10 10 2 3 1 10 5 10 0 Sample Output 1 4 3
 回答 2 已采纳 Seven (actually six) problems may be somewhat few for a contest. But I am really unable to devise another problem related to Fantasy Game Series. So I make up an very easy problem as the closing problem for this contest. Given a sequence of numbers A, for a number X if it has the most instances (elements of the same value as X) in A, then X is called one of the most frequent numbers of A. Now a sequence of numbers A of length L is given, and it is assumed that there is a number X which has more than L / 2 instances in A. Apparently X is the only one most frequent number of A. Could you find out X with a very limited memory? Input Input contains multiple test cases. Each test case there is one line, which starts with a number L (1 <= L <= 250000), followed by L numbers (2^31 ~ 2^311). Adjacent numbers is separated by a blank space. Output There is one line for each test case, which is the only one most frequent number X. Sample Input 5 2 1 2 3 2 8 3 3 4 4 4 4 3 4 Sample Output 2 4
 回答 1 已采纳 Problem Description You are given a sequence of n integers a1 , a2 , ... , an in nondecreasing order. In addition to that, you are given several queries consisting of indices i and j (1 ≤ i ≤ j ≤ n). For each query, determine the most frequent value among the integers ai , ... , aj . Input The input consists of several test cases. Each test case starts with a line containing two integers n and q (1 ≤ n, q ≤ 100000). The next line contains n integers a1 , ... , an(100000 ≤ ai ≤ 100000, for each i ∈ {1, ..., n}) separated by spaces. You can assume that for each i ∈ {1, ..., n1}: ai ≤ ai+1. The following q lines contain one query each, consisting of two integers i and j (1 ≤ i ≤ j ≤ n), which indicate the boundary indices for the query. The last test case is followed by a line containing a single 0. Output For each query, print one line with one integer: The number of occurrences of the most frequent value within the given range. Sample Input 10 3 1 1 1 1 1 1 3 10 10 10 2 3 1 10 5 10 0 Sample Output 1 4 3
 4年前回答 2 已采纳 Problem Description Everyone knows that the letter “E” is the most frequent letter in the English language. In fact, there are one hundred sixteen E’s on this very page ... no, make that one hundred twenty one. Indeed, when spelling out integers it is interesting to see which ones do NOT use the letter “E”. For example 6030 (six thousand thirty) doesn’t. Nor does 4002064 (four million two thousand sixty four). It turns out that 6030 is the 64th positive integer that does not use an “E” when spelled out and 4002064 is the 838th such number. Your job is to find the nth such number. Note: 1,001,001,001,001,001,001,001,001,000 is “one octillion, one septillion, one sextillion, one quintillion, one quadrillion, one trillion, one billion, one million, one thousand”. (Whew!) Input The input file will consist of multiple test cases. Each input case will consist of one positive integer n (less than 231) on a line. A 0 indicates endofinput. (There will be no commas in the input.) Output For each input n you will print, with appropriate commas, the nth positive integer whose spelling does not use an “E”. You may assume that all answers are less than 1028. Sample Input 1 10 838 0 Sample Output 2 44 4,002,064
 4年前回答 1 已采纳 The branch of mathematics called number theory is about properties of numbers. One of the areas that has captured the interest of number theoreticians for thousands of years is the question of primality. A prime number is a number that is has no proper factors (it is only evenly divisible by 1 and itself). The first prime numbers are 2,3,5,7 but they quickly become less frequent. One of the interesting questions is how dense they are in various ranges. Adjacent primes are two numbers that are both primes, but there are no other prime numbers between the adjacent primes. For example, 2,3 are the only adjacent primes that are also adjacent numbers. Your program is given 2 numbers: L and U (1 <= L < U <= 2,147,483,647), and you are to find the two adjacent primes C1 and C2 (L <= C1 < C2 <= U) that are closest (i.e. C2C1 is the minimum). If there are other pairs that are the same distance apart, use the first pair. You are also to find the two adjacent primes D1 and D2 (L <= D1 < D2 <= U) where D1 and D2 are as distant from each other as possible (again choosing the first pair if there is a tie). Input Each line of input will contain two positive integers, L and U, with L < U. The difference between L and U will not exceed 1,000,000. Output For each L and U, the output will either be the statement that there are no adjacent primes (because there are less than two primes between the two given numbers) or a line giving the two pairs of adjacent primes. Sample Input 2 17 14 17 Sample Output 2,3 are closest, 7,11 are most distant. There are no adjacent primes.
 回答 1 已采纳 Problem Description Most of you have probably tried to type an SMS message on the keypad of a cellular phone. It is sometimes very annoying to write longer messages, because one key must be usually pressed several times to produce a single letter. It is due to a low number of keys on the keypad. Typical phone has twelve keys only (and maybe some other control keys that are not used for typing). Moreover, only eight keys are used for typing 26 letters of an English alphabet. The standard assignment of letters on the keypad is shown in the left picture: There are 3 or 4 letters assigned to each key. If you want the first letter of any group, you press that key once. If you want the second letter, you have to press the key twice. For other letters, the key must be pressed three or four times. The authors of the keyboard did not try to optimise the layout for minimal number of keystrokes. Instead, they preferred the even distribution of letters among the keys. Unfortunately, some letters are more frequent than others. Some of these frequent letters are placed on the third or even fourth place on the standard keyboard. For example, S is a very common letter in an English alphabet, and we need four keystrokes to type it. If the assignment of characters was like in the right picture, the keyboard would be much more comfortable for typing average English texts. ACM have decided to put an optimised version of the keyboard on its new cellular phone. Now they need a computer program that will find an optimal layout for the given letter frequency. We need to preserve alphabetical order of letters, because the user would be confused if the letters were mixed. But we can assign any number of letters to a single key. Input There is a single positive integer T on the first line of input. It stands for the number of test cases to follow. Each test case begins with a line containing two integers K, L (1 1, either Pi = Pi1+1 or Pi = 1 3) there are at most K numbers Pi such that Pi = 1 4) the sum of products SP = Fi.Pi is minimal 5) for any other sequence Q meeting these criteria and with the same sum SQ = SP, there exists such M, 1 QM. The output for every test case must start with a single line saying Keypad #I:, where I is a sequential order of the test case, starting with 1. Then there must be exactly K lines, each representing one letter, in the same order that was used in input. Each line must contain the character representing the key, a colon, one space and a list of letters assigned to that particular key. Letters are not separated from each other. Print one blank line after each test case, including the last one. Sample Input 1 8 26 23456789 ABCDEFGHIJKLMNOPQRSTUVWXYZ 3371 589 1575 1614 6212 971 773 1904 2989 123 209 1588 1513 2996 3269 1080 121 2726 3083 4368 1334 518 752 427 733 871 Sample Output Keypad #1: 2: ABCD 3: EFG 4: HIJK 5: LM 6: NOPQ 7: RS 8: TUV 9: WXYZ
 回答 3 已采纳 This question already has an answer here: How can I split a comma delimited string into an array in PHP? 6 answers PHP: Most frequent value in array 2 answers I'm using PHP Codeigniter, and I'm trying to get a string of numbers that are in a single variable to an array where it will produce the most frequent number. I'm trying to do this but it doesn't seem to work. $string_of_numbers = "1, 2, 4, 5, 6, 3, 2, 2, 1, 4, 4, 4"; $numbers = [$string_of_numbers]; But this works $numbers = [1, 2, 4, 5, 6, 3, 2, 2, 1, 4, 4, 4]; I think I'm supposed to convert those string numbers into an interval, but I'm not sure how. $strong_of_numbers = "1, 2, 4, 5, 6, 3, 2, 2, 1, 4, 4, 4"; $numbers = [$strong_of_numbers ]; $count = array_count_values($numbers); // get count of occurrence for each number arsort($count); // sort by occurrence, descending $first = key($count); // get key of first element, because that is the/one $count_first = current($count); // get occurrence for first array value $count_second = next($count); // get occurrence for second array value if($count_first != $count_second) { // did they occur in different frequencies? echo $first . ' occurred most in input array.'; } else { echo 'input array contained multiple values with highest occurrence.'; } End result is that $numbers should accept the $strong_of_numbers as integers, and show the most common/frequent integer.
 回答 1 已采纳 Problem Description You are given a sequence of n integers a1 , a2 , ... , an in nondecreasing order. In addition to that, you are given several queries consisting of indices i and j (1 ≤ i ≤ j ≤ n). For each query, determine the most frequent value among the integers ai , ... , aj . Input The input consists of several test cases. Each test case starts with a line containing two integers n and q (1 ≤ n, q ≤ 100000). The next line contains n integers a1 , ... , an(100000 ≤ ai ≤ 100000, for each i ∈ {1, ..., n}) separated by spaces. You can assume that for each i ∈ {1, ..., n1}: ai ≤ ai+1. The following q lines contain one query each, consisting of two integers i and j (1 ≤ i ≤ j ≤ n), which indicate the boundary indices for the query. The last test case is followed by a line containing a single 0. Output For each query, print one line with one integer: The number of occurrences of the most frequent value within the given range. Sample Input 10 3 1 1 1 1 1 1 3 10 10 10 2 3 1 10 5 10 0 Sample Output 1 4 3
 开心乐源的博客 http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin0.3.12/ Version 0.3.13 is now available. You should upgrade to prevent potential problems with 0/unconfirmed transactions. Note: ...
 mybluetiankong的博客 What do I do if I am getting handshake failed messages in my ONS.LOG file every minute? What should I do to make my Oracle RAC deployment highly available? Can our Oracle RAC 10g VIP fail over from ...
 cuilian2013的博客 What do I do if I am getting handshake failed messages in my ONS.LOG file every minute? What should I do to make my Oracle RAC deployment highly available? Can our Oracle RAC 10g VIP fail over ...
 3年前dearbaba_1666的博客 &lt;?php // Plugin 8: Spell Check // This is an executable example with additional code supplie
 congxinlan3332的博客 What do I do if I am getting handshake failed messages in my ONS.LOG file every minute? What should I do to make my Oracle RAC deployment highly available? Can our Oracle RAC 10g VIP fail over ...
 16年前gtr2002的博客 最近对sip有兴趣，网上竟然没有中文的RFC3261.决定了，自己翻译。嘿嘿 大工程。。。Network Working Group J. Rosenberg Request for Comments: 3261 dynamicsoft Obsoletes: 2543 H. Schulzrinne Category: ...
 12年前wapysun的博客 Why am I seeing the following warnings in my listener.log for my RAC 10g environment? WARNING: Subscription for node down event still pending Will FAN work with SQLPlus? Do I need to ...
 richardisused的博客 Network Working Group J. RosenbergRequest for Comments: 3261 dynamicsoftObsoletes: 2543
 回答 1 已采纳 I'm trying to create an XMPP library (and later a server) from scratch in Go (although the language itself is irrelevant) as a means to learn what I can about the XMPP protocol and server software development in general. As many of you know, XMPP is messaging protocol based on XML that depends on an enormous amount of short but frequent XML streams. I'm thinking that for such applications an event based XML parser should be better because I won't need DOM and all that (correct me if I'm wrong). Please keep in mind that this library is intended for servers so there might be many instances run at once; Which one of the two has better performance and memory usage for that use case, libxml2 or expat?