[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: SYN trouble, hardware or software?
On 22 Jul 1998, Andi Kleen wrote:
> Geert Uytterhoeven <> writes:
> > On Wed, 22 Jul 1998, Chris Black wrote:
> > > handshake (I think). We get messages on the master suck as:
> > > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from
> > > on Sending cookies.


> The warning simply means that connection requests are comming in faster
> than the server can process them.
> The syn cookie code keeps no per host state of course, just a
> per-socket-global counter and timestamp (it would make no sense because in
> real syn flood attacks the source addresses are usually forged). So the
> syn cookie code will just report one packet that happened to overflow
> the backlog queue (and that the warning message load limiter let through)


BTW, one of the other persons on our net winnuked the first IP address that was
assumed to be a SYN flooder. It brought that machine down, but IIRC the SYN
flood warnings didn't stop until I rebooted the server.



Geert Uytterhoeven
Wavelets, Linux/{m68k~Amiga,PPC~CHRP}
Department of Computer Science -- Katholieke Universiteit Leuven -- Belgium

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:43    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean