lkml.org 
[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: SYN trouble, hardware or software?
On Wed, 22 Jul 1998, Chris Black wrote:
> handshake (I think). We get messages on the master suck as:
> Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.12 on 192.168.1.1:20817. Sending cookies.
> Jul 21 20:53:13 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.7 on 192.168.1.1:20860. Sending cookies.
> Jul 21 20:56:15 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.11 on 192.168.1.1:20885. Sending cookies.
> Jul 21 20:57:40 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.7 on 192.168.1.1:20897. Sending cookies.
> Jul 21 21:01:30 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.7 on 192.168.1.1:20931. Sending cookies.
> Jul 21 21:04:20 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.9 on 192.168.1.1:20954. Sending cookies.
> Jul 22 14:11:13 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.4 on 192.168.1.1:24225. Sending cookies.
> Jul 22 15:23:00 isrec-insect kernel: Warning: possible SYN flood from
> 192.168.1.9 on 192.168.1.1:9393. Sending cookies.
>
> (er, that "suck" should be "such", but "suck" also applies)
>
> And on the slaves we get similar messages:
> Jul 19 22:49:26 insect-01 kernel: Warning: possible SYN flood from
> 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> Jul 19 23:11:32 insect-01 kernel: Warning: possible SYN flood from
> 127.0.0.1 on 127.0.0.1:9027. Sending cookies.
> Jul 20 15:23:54 insect-01 kernel: Warning: possible SYN flood from
> 192.168.1.1 on 192.168.1.2:9027. Sending cookies.
>
> Although the SYN messages on the master are understandably much more
> frequent
> than the ones on the slaves. I find it odd that even a socket to the
> localhost
> can generate incomplete SYN-initiated handshakes on the slaves. The
> processes
> that run on the slaves do use sockets to localhost to communicate to
> processes
> on the same host. This could be changed to be IPC shm or temporary
> FIFOs, but
> sockets to localhost are used for now.
> No communication is done between the slaves, it is all master<->slave.

...

> Software:
> redhat linux 4.2, kernel 2.0.35 with "Jumbo-4" cyrix/cpuid patch.

I've seen this on a 2.0.34 box (i486SX, 2x NE2000, 1x 3c509, routing,
masquerading). People complained that FTP to the box no longer worked, and
there were SYN flooding warnings in the logs.

Then I tried to FTP from a box that was guaranteed not doing a SYN attack, and
that box appeared in the kernel log as a possible attacker too. Rebooting the
server fixed the problem. So I think this is a bug in the networking code.

Greetings,

Geert

--
Geert Uytterhoeven Geert.Uytterhoeven@cs.kuleuven.ac.be
Wavelets, Linux/{m68k~Amiga,PPC~CHRP} http://www.cs.kuleuven.ac.be/~geert/
Department of Computer Science -- Katholieke Universiteit Leuven -- Belgium


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.altern.org/andrebalsa/doc/lkml-faq.html

\
 
 \ /
  Last update: 2005-03-22 13:43    [W:0.039 / U:0.464 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site