Atomicorp

My gamera server seems to be under ddos syn attack.

maillog file don't help becaasue i've so many connections it can't process a bit.

i know it should be solved firewall side but maybe there something i can look into the gamera server to understand which webiste (if any) is under the attack ?

The server runs only gamera system, nothing else.

Not really, you can try and drop the traffic with firewall rules, although if its a syn flood I suspect they're probably spoofing the src ip.

scott wrote:Not really, you can try and drop the traffic with firewall rules, although if its a syn flood I suspect they're probably spoofing the src ip.

Yes Scott, it was syn flood.
I took all the suggested action to prevent it working on tcp/firewall.
It was the first time i had this kind of attack on a antispam gw. Very strange from my point of view.

I've to say that during attack my load was ... 0.2
The system seems to be solid