Messages in this thread | | | Date | Wed, 22 Jul 1998 18:36:13 +0200 (CEST) | From | Geert Uytterhoeven <> | Subject | Re: SYN trouble, hardware or software? |
| |
On Wed, 22 Jul 1998, Chris Black wrote: > handshake (I think). We get messages on the master suck as: > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.12 on 192.168.1.1:20817. Sending cookies. > Jul 21 20:53:13 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.7 on 192.168.1.1:20860. Sending cookies. > Jul 21 20:56:15 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.11 on 192.168.1.1:20885. Sending cookies. > Jul 21 20:57:40 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.7 on 192.168.1.1:20897. Sending cookies. > Jul 21 21:01:30 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.7 on 192.168.1.1:20931. Sending cookies. > Jul 21 21:04:20 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.9 on 192.168.1.1:20954. Sending cookies. > Jul 22 14:11:13 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.4 on 192.168.1.1:24225. Sending cookies. > Jul 22 15:23:00 isrec-insect kernel: Warning: possible SYN flood from > 192.168.1.9 on 192.168.1.1:9393. Sending cookies. > > (er, that "suck" should be "such", but "suck" also applies) > > And on the slaves we get similar messages: > Jul 19 22:49:26 insect-01 kernel: Warning: possible SYN flood from > 127.0.0.1 on 127.0.0.1:9027. Sending cookies. > Jul 19 23:11:32 insect-01 kernel: Warning: possible SYN flood from > 127.0.0.1 on 127.0.0.1:9027. Sending cookies. > Jul 20 15:23:54 insect-01 kernel: Warning: possible SYN flood from > 192.168.1.1 on 192.168.1.2:9027. Sending cookies. > > Although the SYN messages on the master are understandably much more > frequent > than the ones on the slaves. I find it odd that even a socket to the > localhost > can generate incomplete SYN-initiated handshakes on the slaves. The > processes > that run on the slaves do use sockets to localhost to communicate to > processes > on the same host. This could be changed to be IPC shm or temporary > FIFOs, but > sockets to localhost are used for now. > No communication is done between the slaves, it is all master<->slave.
...
> Software: > redhat linux 4.2, kernel 2.0.35 with "Jumbo-4" cyrix/cpuid patch.
I've seen this on a 2.0.34 box (i486SX, 2x NE2000, 1x 3c509, routing, masquerading). People complained that FTP to the box no longer worked, and there were SYN flooding warnings in the logs.
Then I tried to FTP from a box that was guaranteed not doing a SYN attack, and that box appeared in the kernel log as a possible attacker too. Rebooting the server fixed the problem. So I think this is a bug in the networking code.
Greetings,
Geert
-- Geert Uytterhoeven Geert.Uytterhoeven@cs.kuleuven.ac.be Wavelets, Linux/{m68k~Amiga,PPC~CHRP} http://www.cs.kuleuven.ac.be/~geert/ Department of Computer Science -- Katholieke Universiteit Leuven -- Belgium
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html
| |