Re: [squid-users] possible SYN flooding on port 3128

From: Henrik Nordstrom <henrik_at_henriknordstrom.net>
Date: Sat, 28 Nov 2009 01:58:07 +0100

ons 2009-11-25 klockan 05:51 -0800 skrev Landy Landy:

> I also checked netstat -nat and noticed a lot about 1200 of ESTABLISHED connections from one ip address.
>
> I called this person and told me no one was using that machine.

> echo 1 > /proc/sys/net/ipv4/tcp_syncookies
>
> Is this a virus? Any suggestions?

Probably that machine is hit by a worm.

Regards
Henrik
Received on Sat Nov 28 2009 - 00:58:15 MST

This archive was generated by hypermail 2.2.0 : Sun Nov 29 2009 - 12:00:04 MST