ddos attack

ivan · Unread post by **ivan** » Thu Dec 13, 2007 3:01 pm

My gamera server seems to be under ddos syn attack.

maillog file don't help becaasue i've so many connections it can't process a bit.

i know it should be solved firewall side but maybe there something i can look into the gamera server to understand which webiste (if any) is under the attack ?

The server runs only gamera system, nothing else.

Unread post by **scott** » Fri Dec 14, 2007 10:38 am

Not really, you can try and drop the traffic with firewall rules, although if its a syn flood I suspect they're probably spoofing the src ip.

ivan · Unread post by **ivan** » Mon Dec 17, 2007 6:59 pm

scott wrote:Not really, you can try and drop the traffic with firewall rules, although if its a syn flood I suspect they're probably spoofing the src ip.

Yes Scott, it was syn flood.
I took all the suggested action to prevent it working on tcp/firewall.
It was the first time i had this kind of attack on a antispam gw. Very strange from my point of view.

I've to say that during attack my load was ... 0.2
The system seems to be solid