[lkml]   [1998]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: SYN trouble, hardware or software?
    On 22 Jul 1998, Andi Kleen wrote:
    > Geert Uytterhoeven <> writes:
    > > On Wed, 22 Jul 1998, Chris Black wrote:
    > > > handshake (I think). We get messages on the master suck as:
    > > > Jul 21 20:47:58 isrec-insect kernel: Warning: possible SYN flood from
    > > > on Sending cookies.


    > The warning simply means that connection requests are comming in faster
    > than the server can process them.
    > The syn cookie code keeps no per host state of course, just a
    > per-socket-global counter and timestamp (it would make no sense because in
    > real syn flood attacks the source addresses are usually forged). So the
    > syn cookie code will just report one packet that happened to overflow
    > the backlog queue (and that the warning message load limiter let through)


    BTW, one of the other persons on our net winnuked the first IP address that was
    assumed to be a SYN flooder. It brought that machine down, but IIRC the SYN
    flood warnings didn't stop until I rebooted the server.



    Geert Uytterhoeven
    Wavelets, Linux/{m68k~Amiga,PPC~CHRP}
    Department of Computer Science -- Katholieke Universiteit Leuven -- Belgium

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:43    [W:0.020 / U:7.916 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site