RE: [cobalt-users] RaQ3 dies again for no reason - we maybe no reason

["Andy Brown" <andy.brown@xxxxxxxxxxxxx>]

<snip>
> Me again :)  The RaQ3 that died for no reason last week died 
> again tonight.
> 
> On the logs an hour before it died the following could be seen...
> Aug 6 19:18:34 ns kernel: possible SYN flooding on port 80. 
> Sending cookies.
</snip>

I agree, that it looks very strange, in that although you were getting a good few attacks, nothing unusual.

I'd be starting to suspect a network card problem, as it may be when the card becomes too saturated it looses its connectivity or just drops connections or something along those lines.
Again, this is strange though as you'd normally expect an error back from the ethernet drivers in the kernel to dump something to syslog (either messages or the kernel message file)

Does the machine do very much traffic normally?

It might actually be worth, trying to cause this again yourself (check with your provider first!) try doing the same kind of attack to your box in rapid succession and see if it falls over again. If it does, then i'd say its down to either the packet filters for some reason either locking everything down, or causing the network card to fail, or indeed the network card itself.

Regards,

Andy
andy@xxxxxxxxxx
http://www.raqpak.com/ <-- Raq/Qube unofficial PKGs and support advice