lkml.org 
[lkml]   [1997]   [Dec]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: How definite are the SYN flood warnings?
On Tue, 16 Dec 1997, Felix von Leitner wrote:

> I received several warnings in the log file of our production server,
> all in the form
>
> /var/log/messages:Dec 3 04:01:18 yabba kernel: Warning: possible SYN flood from a.b.c.d on ip.of.my.box:113. Sending cookies.
>
> Now, this looks to me like some bozo tried to synflood me. Probably had
> a look at my server and found almost no TCP services running, thought it
> could be an NT box and wouldn't it be fun to nuke me.

The synflood protection (at least in 2.0.x) is a bit too easily set off.
i.e. I get messages like:
Warning: possible SYN flood from 205.229.53.70 on 205.229.48.18:119.
Sending cookies.
validated probe(205.229.53.70:1175, 205.229.48.18:119, 1365466301)

on my news server all the time. In your case, it was the auth service
being hit hard enough for the kernel to suspect syn flooding. In many
cases, it's a false alarm.


------------------------------------------------------------------
Jon Lewis <jlewis@fdt.net> | Unsolicited commercial e-mail will
Network Administrator | be proof-read for $199/message.
Florida Digital Turnpike |
______http://inorganic5.fdt.net/~jlewis/pgp for PGP public key____


\
 
 \ /
  Last update: 2005-03-22 13:40    [W:0.052 / U:0.196 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site