New Denial of Service Attack on Panix
Paul Ferguson
pferguso at cisco.com
Wed Sep 18 23:19:13 UTC 1996
For what its worth, we are looking at this.
- paul
At 04:32 PM 9/17/96 -0700, Leonid Egoshin wrote:
>>From: "Forrest W. Christian" <forrestc at iMach.com>
>>
>> 5 minute SYNS: 123423 5 minute SYN-ACKS: 50000
>>
>>Then, if the ratio got too high, it can start yelping about "Potential SYN
>>D-O-S Atttack in progress on Interface Serial 1"
>
> I suggest to check not only ratio (assymetric routing !),
>but high number of SYNs to single host.
>
> - Leonid Yegoshin, LY22
>
--
Paul Ferguson || ||
Consulting Engineering || ||
Reston, Virginia USA |||| ||||
tel: +1.703.716.9538 ..:||||||:..:||||||:..
e-mail: pferguso at cisco.com c i s c o S y s t e m s
More information about the NANOG
mailing list