lkml.org 
[lkml]   [1997]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: SYN flooding....
Date

Chris Evans <chris@ferret.lmh.ox.ac.uk> writes:
>
>My kernel deemed it neccessary to say...
>
>Warning: possible SYN flooding. Sending cookies.
>
>How kind of it. But FROM WHO????
Two things:

(1) this does not necessarily mean you are getting syn flooded.
Note the word "possible". All that you can really say is that
you had more incoming requests for connects than you could
deal with. It may only mean that you should increase your listen
backlog on some service. If you are really under attack you
should be seeing lots of these messages. The 2.1.31 code should
at least report the port number so you know what service needs
to have its backlog increased.

(2) If you are really under attack, then by the very nature of the
SYN flood attack it is not possible to know from whom the attack
is coming. The kernel only knows the spoofed address on the the
SYN packets that are arriving, and those are anything but the
address of the attacker.

--
Eric Schenk www: http://www.dna.lth.se/~erics
Dept. of Comp. Sci., Lund University email: Eric.Schenk@dna.lth.se
Box 118, S-221 00 LUND, Sweden fax: +46-46 13 10 21 ph: +46-46 222 96 38

\
 
 \ /
  Last update: 2005-03-22 13:39    [W:0.061 / U:0.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site