Re: [cobalt-users] RaQ4 - dmesg

[flash22@xxxxxxx]

On Thu, 17 Jan 2002, Richard Sidlin wrote:

> I looked at dmesg on my live RaQ and wondered if the following, at the
> bottom of the report is a problem?

> possible SYN flooding on port 110. Sending cookies.

I guess it depends what you mean by 'problem' ;P
It's most likely an automated scanner looking for vulnerable pop3 servers,
it generared a SYN flood because it walked IP addresses in sequence very
fast, thinking they are different machines, but in fact they all go to
your machine so you saw a lot of connection opens happen very fast and the
kernel got upset...(SYN = TCPspeak for open connection ;)

Assuming you have been keeping your software up to date, it's not much
more than a minor annoyance....or a reminder that the kiddies are still
playing ;P

Chances are it's automated from some other machine that's compromised, but
be carefull about yelling at anyone, the IP's listed by the kernel in
response to SYN floods aren't totally reliable...

(The cookies are specially designed packets designed to place the burden
of opening a connection back on the sender, hopefully to make it behave
itself, or at least minimize the impact on the server)

gsh