| George Theall on 14 Feb 2004 03:50:03 -0000 |
|
On Fri, Feb 13, 2004 at 09:34:50PM -0500, Kevin Brosius wrote: > I haven't analyzed the incoming traffic, beyond noting the heavy load, > doing a netstat, and seeing the kernel mention "possible SYN flooding on > port 80". What's the best way to check that? Looks like you have SYN cookies enabled in your kernel and it's sending out cookies in response to a high amount of traffic to your web server. You said you're using iptables to block traffic, right? If you haven't done so already, add a rule to log traffic from that host, perhaps with rate limit. George -- theall@tifaware.com Attachment:
pgpUcr4lOw7rc.pgp
|
|