First let me preface by saying I am still new to linux, but I am learning so pardon my ignorance if I appear to be asking simple questions.

quick background:

My company has a linux box (redhat) acting as a front end mail server, it accepts mail for our domain passes it through spamassassin then onto our exchange server.

The linux box sits in the dmx zone of our firewall.

Our firewall is now reporting the following:

The cache is full; 20460 open connections; some will be dropped - Source:xxx.xxx.242.253 (ip partial removed to prevent any mal intent), 49941, DMZ - Destination:220.140.143.154, 80, WAN -

The firewall proceeds to lock up until this "attack" subsides.

Has anyone ever experianced anytrhing like this before? any help would be appreciated.

wdawson:
Run this command:
cat /proc/sys/net/ipv4/ip_conntrack_max

Then double it like so:
echo 64535 > /proc/sys/net/ipv4/ip_conntrack_max

Of course, the number you use (64535 in my example) may be different.

If it's not this parameter, look around for other relevant parameters and do some googling.

Hope that helps. Keep us posted.

could it be a SYN flood?? if so, try a: