Synchronous inetd coredumping over multiple zones

Question

We're experiencing rather strange behaviour on several of our zoned systems (some M5k's, 5220's, T2000's),
in that some Solaris daemons (mostly the inetd) are repeatedly coredumping, in all zones at the same time.
Aug 2 13:29:01 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18080] core dumped: /var/core/core_zone1_inetd_0_0_1217676540_18080
Aug 2 13:29:02 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18094] core dumped: /var/core/core_zone2_inetd_0_0_1217676541_18094
Aug 2 13:29:02 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18247] core dumped: /var/core/core_zone1_inetd_0_0_1217676542_18247
Aug 2 13:29:03 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18261] core dumped: /var/core/core_zone2_inetd_0_0_1217676543_18261
Aug 2 13:29:04 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18275] core dumped: /var/core/core_zone2_inetd_0_0_1217676543_18275
Aug 2 13:29:05 so02 genunix: [ID 603404 kern.notice] NOTICE: core_log: inetd[18285] core dumped: /var/core/core_zone1_inetd_0_0_1217676544_18285
These always seem to come in bursts of three crash rounds, then it's running fine for a few days, and suddenly another burst of coredumps - on average twice a week.
The machines are not visible to the internet, and as it also happens on weekends, so I think I can rule out some malicious user trying to exploit some flaw in inetd causing it to crash.
Anyone got a hint what might cause this, or how to trace the issue back?

Answer 1

Smells like a bug in inetd that is being tickled by a port scan. If someone in your organization is doing scanning, it could hit all your zone IPs within a short period of time.
If you can't find who's responsible via other methods (asking around), I'd set up a zone that isn't doing anything (so it has almost no network traffic). Then I'd run snoop to watch traffic for that hostname just before you might expect it again. Then go back and correlate the traffic after you find inetd down again. By having the zone otherwise idle, the snoop traffic should be light enough that you can run it for hours with little impact.
Darren