<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Aug 16, 2019, at 5:04 PM, Jim Shankland <<a href="mailto:nanog@shankland.org" class="">nanog@shankland.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">Greetings,<br class="">
<br class="">
I'm seeing slow-motion (a few per second, per IP/port pair) syn flood attacks ostensibly originating from 3 NL-based IP blocks: 88.208.0.0/18 , 5.11.80.0/21, and 78.140.128.0/18 ("ostensibly" because ... syn flood, and BCP 38 not yet fully adopted).<br class="">
<br class="">
Why is this syn flood different from all other syn floods? Well ...<br class="">
<br class="">
1. Rate seems too slow to do any actual damage (is anybody really bothered by a few bad SYN packets per second per service, at this point?); but<br class="">
<br class="">
2. IPs/port combinations with actual open services are being targeted (I'm seeing ports 22, 443, and 53, just at a glance, to specific IPs with those services running), implying somebody checked for open services first;<br class="">
<br class="">
3. I'm seeing this in at least 2 locations, to addresses in different, completely unrelated ASes, implying it may be pretty widespread.<br class="">
<br class="">
Is anybody else seeing the same thing? Any thoughts on what's going on? Or should I just be ignoring this and getting on with the weekend?<br class="">
<br class="">
Jim<br class="">
</div>
</div>
</blockquote>
<br class="">
</div>
<div>We are seeing that here also. Saw similar traffic ostensibly originating from NL at least as long ago as last Sunday August 17.</div>
<br class="">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
— <br class="">
Bruce Curtis <a href="mailto:bruce.curtis@ndsu.edu" class="">
bruce.curtis@ndsu.edu</a><br class="">
Certified NetAnalyst II 701-231-8527<br class="">
North Dakota State University </div>
</div>
</div>
<br class="">
</body>
</html>