search for: flood

Perhaps someone will help me on this :- I have read a lot of examples of syn flood protect on the INPUT chain. That I have no question at all. I wonder if it make sense to perform syn flood protection at the FORWARD chain ? If packets are originated from a LAN worm, and are not targetted at the firewall itself, but rather at hosts in the internet, will it cause problem with the...

Hi folks, I have here a database node running # rpm -qa | grep mysql-server mysql55-mysql-server-5.5.52-1.el6.x86_64 on # virt-what vmware that seems to have a connection problem: # dmesg |grep SYN |tail -5 possible SYN flooding on port 3306. Sending cookies. possible SYN flooding on port 3306. Sending cookies. possible SYN flooding on port 3306. Sending cookies. possible SYN flooding on port 3306. Sending cookies. possible SYN flooding on port 3306. Sending cookies. I adapted already following: # sysctl -a |grep -E...

Hi *Problem *- I'm running Icecast in a VM container on OpenVZ. Syslog on the hardware node (HN) shows these error messages: Jan 23 18:43:05 HN kernel: [27469893.430615] possible SYN flooding on port 8000. Sending cookies. Jan 23 21:37:40 HN kernel: [27480362.817944] possible SYN flooding on port 8000. Sending cookies. Jan 23 23:43:50 HN kernel: [27487929.582025] possible SYN flooding on port 8000. Sending cookies. Jan 24 00:27:34 HN kernel: [27490551.695794] possible SYN flooding on...

Hi, I'm new to this list but not to Samba. I've recently been having problems with Samba that I have not encountered (ever). I cannot determine what the cause is but an hour or so into my dialup connection, my machine starts flooding the first dns server in /etc/resolv.conf with dns requests. I know it's samba responsible for the flooding because as soon as I kill both smbd and nmbd with /etc/init.d/samba stop, the flood stops. Is there any information on this behaviour ? Or perhaps do I have something configured incorr...

Hello, I current have a FreeBSD 4.8 bridge firewall that sits between 7 servers and the internet. The servers are being attacked with syn floods and go down multiple times a day. The 7 servers belong to a client, who runs redhat. I am trying to find a way to do some kind of syn flood protection inside the firewall. Any suggestions would be greatly appreciated. -- Ryan James ryan@mac2.net

Hi guys, Sorry if this is a little offtopic, but I was wandering what can one do to prevent/stop arp flooding ? Thanks, Alex -- This message has been scanned for viruses and dangerous content by LG-Network(http://www.lgnet.ro), and is believed to be clean.

...; >> # rpm -qa | grep mysql-server >> mysql55-mysql-server-5.5.52-1.el6.x86_64 >> >> on >> >> # virt-what >> vmware >> >> >> that seems to have a connection problem: >> >> # dmesg |grep SYN |tail -5 >> possible SYN flooding on port 3306. Sending cookies. >> possible SYN flooding on port 3306. Sending cookies. >> possible SYN flooding on port 3306. Sending cookies. >> possible SYN flooding on port 3306. Sending cookies. >> possible SYN flooding on port 3306. Sending cookies. >> >&gt...

...ntos / Sendmail boxes on port 110. These servers require a reboot after each attack. My firewall says it's blocked? Do I need to patch something on sendmail? Or is my firewall not doing its job (Sonicwall)? This is not the first time this has happened. 11/20/2008 02:53:04.864 - SYN flood attack dropped - 75.2.205.141, 48102 - 10.80.80.210, 110 11/20/2008 03:08:04.864 - SYN flood attack dropped - 75.2.205.141, 64955, greatcooks.biz - 10.80.80.220, 110 11/20/2008 03:23:08.864 - SYN flood attack dropped - 75.2.205.141, 43068, greatcooks.biz - 10.80.80.210, 110...

...i folks, > > I have here a database node running > > # rpm -qa | grep mysql-server > mysql55-mysql-server-5.5.52-1.el6.x86_64 > > on > > # virt-what > vmware > > > that seems to have a connection problem: > > # dmesg |grep SYN |tail -5 > possible SYN flooding on port 3306. Sending cookies. > possible SYN flooding on port 3306. Sending cookies. > possible SYN flooding on port 3306. Sending cookies. > possible SYN flooding on port 3306. Sending cookies. > possible SYN flooding on port 3306. Sending cookies. > > > I adapted already...

Hello, after some days running without problems, my riello idialog 800 ups get disconnected, and usbfs started flooding syslog with messages like: usb 1-1.2: usbfs: process 57342 (riello_usb) did not claim interface 0 before use Version is 2.7.1-1 debian packages, which I backported from sid to wheezy. Any hint? rob

Hello all. I was recently the victim of a SIP flood attack. I'm wondering what is the best method to prevent such things in the future. Many thanks Greg -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.digium.com/pipermail/asterisk-users/attachments/20101003/2e254523/attachment.htm

On 22 febbraio 2014 17:28:16 CET, Roberto Resoli <roberto at resolutions.it> wrote: >Hello, > >after some days running without problems, my riello idialog 800 ups >get disconnected, and usbfs started flooding syslog with messages like: > >usb 1-1.2: usbfs: process 57342 (riello_usb) did not claim interface 0 >before use > >Version is 2.7.1-1 debian packages, which I backported from sid to >wheezy. > >Any hint? >rob > >_______________________________________________ &...

Hello, any idea why the Asterisk CLI gets flooded by these messages ? How can the SIP peer /vita3/ cause this flood ? [Apr 2 11:45:48] VERBOSE[17029] app_dial.c: [Apr 2 11:45:48] -- SIP/vita3-000010af requested media update control 26, passing it to SIP/708708-000010b3 [Apr 2 11:45:48] VERBOSE[17029] app_dial.c: [Apr 2 11:45:48] -- SI...

...try to ping from one of the VLAN interfaces, through a host connected to a VLAN switch, while dumping the traffic, the following happens: - Host sends ARP who-has broadcast to the VLAN interface (tagged correctly, originating from the host MAC) - Linux receives the who-has and does 2 things: - It floods all VLAN interfaces with the same ARP who-has request - It responds with a unicast is-at on the correct VLAN interface The question is: why does it flood while the ARP is destined to the bridge interface? The problem: I have a another switch connected passively between the Linux box and the VLA...

Il 22/02/2014 23:11, Roberto Resoli ha scritto: > On 22 febbraio 2014 17:28:16 CET, Roberto Resoli <roberto at resolutions.it> wrote: >> Hello, >> >> after some days running without problems, my riello idialog 800 ups >> get disconnected, and usbfs started flooding syslog with messages like: >> >> usb 1-1.2: usbfs: process 57342 (riello_usb) did not claim interface 0 >> before use >> >> Version is 2.7.1-1 debian packages, which I backported from sid to >> wheezy. >> >> Any hint? Some more data: it appears th...

Dear all, I am a new member to the list - and to the analysis that I am attempting. I have the following case A group of us have been monitoring (over a period of a few years) a number of paired plots that were flooded and / or burnt. The plots are located in two topographical settings, some were burnt, some were flooded, some were burnt & flooded and some were not affected at all. At each location one plot was fenced to exclude grazing while another was left unfenced to include the effect of grazing. Eff...

On a Linux Server running tincd I noticed the following log message in /var/log/messages kernel: possible SYN flooding on port 655. Sending cookies. I found this on the web: If SYN cookies are enabled, then the kernel doesn't track half open connections at all. Instead it knows from the sequence number in the following ACK datagram that the ACK very probably follows a SYN and a SYN-ACK. That way SYN floods...

Hi, We are trying to track some specific rules using LOG as target. Everything is working well but the problem is that iptables is flooding the console with LOG messages. We tried --log level 4 on iptables rules but it didn't work. We fixed the problem changing KLOGD_OPTIONS value in /etc/sysconfig/syslog to: KLOG_OPTIONS="-c 4" Is it the best option or we are missing something? Thanks in advance

...you very much, Gustavo. ########## library(sem) grace <- matrix(ncol = 10, nrow = 10) variables <- c("lightlog", "light", "dstb", "species_count", "masslog", ? ? ? ? ? ? ? "soil_carbon", "soil_organic", "soil_low_flooding", ? ? ? ? ? ? ? "soil_high_flooding", "soil_salinity") rownames(grace) <- colnames(grace) <- variables diag(grace) <- 1 ## Coefficients from the paper. grace.coefficients <- c(0.858, 0.667, -0.251, -0.699, 0.06, 0.012, 0.552, 0.547, ? ? ? ? ? ? ? ? ? ? ?...

I just received a flood of e-mails from the list, over 200 messages, with dates going back to July 2006. They all appear to be legitimate messages based on the header info and the body. Since I only joined the list a month ago, I doubt it's me. Is there something wrong with mailman? Or has someone contracted a vi...