server freeze: possible SYN flooding on port ?

roycke · Nov 29th 2011

i have installed last week a ubuntu 10x server with cccam.
this week it 2x stopped for now reason.
when i looked at var/log/messages it gives this:
Nov 29 15:09:00 ubuntu kernel: [112920.866534] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:10:22 ubuntu kernel: [113002.243056] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:11:35 ubuntu kernel: [113075.870790] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:12:36 ubuntu kernel: [113136.628463] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:13:45 ubuntu kernel: [113206.007073] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:15:15 ubuntu kernel: [113295.963727] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:16:30 ubuntu kernel: [113370.934025] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:17:34 ubuntu kernel: [113434.755281] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:18:50 ubuntu kernel: [113510.658666] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:20:00 ubuntu kernel: [113580.981041] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:21:00 ubuntu kernel: [113641.018767] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:22:02 ubuntu kernel: [113702.600129] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:23:02 ubuntu kernel: [113762.751008] possible SYN flooding on port 12000. Sending cookies.

how can i blok or solve this problem?

**master G** · Nov 29th 2011

You could change your default CCcam port to something else, also have a look at this.

Code

http://linux-journal.blogspot.com/2005/04/defending-your-linux-box-against-syn.html

**master G** · Nov 29th 2011

SYN flooding is denial of service attack (dos attack)
Unusal for a hobbyist, how big is your server?
change port as master G said i would also have a close look at who you have/are sharing with.

roycke · Nov 29th 2011

ok. thanks. i have no big server only 40 clients. but also serveral offline client ill gues someone inthere is playing.
is it not possible 2 get the ip adres from this attack and block it in the firewall?

thanks.

**master G** · Nov 29th 2011

The first thing i would do mate is google your own dns address, if you view the cccam logs you should be able to see where its comming from.

**master G** · Nov 29th 2011

If you install webmin you will find all your logs in one place /system/system logs/, making it much easier to keep track of errors and access attempts.

roycke · Nov 29th 2011

my vigor router has syn flood defence.
i have enabled that. hope this helps.

marian34 · Aug 22nd 2013

Quote from roycke

i have installed last week a ubuntu 10x server with cccam.
this week it 2x stopped for now reason.
when i looked at var/log/messages it gives this:
Nov 29 15:09:00 ubuntu kernel: [112920.866534] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:10:22 ubuntu kernel: [113002.243056] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:11:35 ubuntu kernel: [113075.870790] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:12:36 ubuntu kernel: [113136.628463] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:13:45 ubuntu kernel: [113206.007073] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:15:15 ubuntu kernel: [113295.963727] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:16:30 ubuntu kernel: [113370.934025] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:17:34 ubuntu kernel: [113434.755281] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:18:50 ubuntu kernel: [113510.658666] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:20:00 ubuntu kernel: [113580.981041] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:21:00 ubuntu kernel: [113641.018767] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:22:02 ubuntu kernel: [113702.600129] possible SYN flooding on port 12000. Sending cookies.
Nov 29 15:23:02 ubuntu kernel: [113762.751008] possible SYN flooding on port 12000. Sending cookies.

how can i blok or solve this problem?

Display More

Hello, I managed to solve the problem?

marian34 · Aug 26th 2013

It seems that the cause of this condition (which has features of DDoS attack), may be imperfect cable connection ...

server freeze: possible SYN flooding on port ?

Your resource for Linux TV servers and smart card readers.

Participate now!

Share

Tags