"syn flood attack" How do I investigate this?

oily_rags · 04-28-2005, 07:53 PM

I have been reading many lines in my routers log saying "syn flood attack detected, packet dropped" No ip for the alleged attacker is displayed though. How do I know if this is a real attack and not a false positive, and more importantly, find out who is trying to attack me?
Does suse 9.3 contain any tools in it's firewall or elsewhere that can analize the traffic? Or are there programs I should download and install for this purpose? Thanks

jonr · 04-28-2005, 09:26 PM

You might try a program called ethereal. It will capture your Internet traffic and give you very detailed information on what's going on. I used it to solve what I thought was an attack on my system. To my embarrassment I discovered it was a ping I had left running for something like forty-eight hours...

Ethereal will show you the IP address of the incoming traffic and you can go from there. Worth a try.

oily_rags · 04-28-2005, 09:29 PM

cool thanks john I appreciate the info, i'll give ethereal a try, thanks!