i got a bunch of messages from my router this morning about a syn flood attack. the messages look like this:
etc., about 4x that amount per message, in 12 separate messages.

so what happened? my webserver is running fine and there are no signs of cracking that i can see (log checks, chkrootkit, disk space/memory are fine, etc.) was it a successful DoS attack that i just didn't notice because i didn't happen to be trying to access the website during the attack?

from what i understand doing some research this morning, it's almost impossible to defend against a syn flood attack. i guess it was either random, or maybe some windows j3rk0ff on a forum where i was advocating linux deciding they were going to "teach me a lesson." should i cycle my modem and/or router and change the IP? the packet dropped seems like it was detected and averted, but i'm unclear about what the "send mail succeed" part means.

thx

The "Send mail succeeded" is likely the routers programmed response to attack detection. Check the documentation for the router to direct the email at an actual address, if you have not already done so.

It wouldn't hurt to reset your router and obtain a new ip. It may also be a false positive, caused by a sweeping port scan or something similar.

as i recall syn floods can be minimized by a kernel option "sync cookies" if i remember right