nslookup does not give any result on those IP addresses. So not able to figure out who is causing this. Is there a way to check the reason, why they do not answer to the SYN-ACK's? Thanks and Regards Puneet ----------------------------------------
Date: Thu, 6 Nov 2014 15:30:46 +0100 From: me@sillymon.ch To: puneet.agr@outlook.com CC: kernelnewbies@kernelnewbies.org Subject: Re: lots of connections in SYN_RECV state
Hi
Am 2014-11-06 14:27, schrieb Puneet Agarwal:
I have a couple of servers, for the past few days I am seeing lots of connections in SYN_RECV state in netstat commands output.
This *could* be the result of a SYN-flood attack on your server.
Is there a solution to this problem?
The Wikipedia page mentions some countermeasures (if it indeed is an attack and not a networking stack issue).
http://en.wikipedia.org/wiki/SYN_flood
Maybe you could check from which IP addresses these SYNs come from and investigate why they do not answer to the SYN-ACK request of your server.
Cheers,
Silvan