[4514] in North American Network Operators' Group
Re: New Denial of Service Attack on Panix
daemon@ATHENA.MIT.EDU (Leonid Egoshin)
Tue Sep 17 19:39:00 1996
Date: Tue, 17 Sep 1996 16:32:46 -0700 (PDT)
From: Leonid Egoshin <egoshin@genesyslab.com>
To: forrestc@iMach.com, nanog@merit.edu
Cc: iepg@iepg.org
>From: "Forrest W. Christian" <forrestc@iMach.com>
>
> 5 minute SYNS: 123423 5 minute SYN-ACKS: 50000
>
>Then, if the ratio got too high, it can start yelping about "Potential SYN
>D-O-S Atttack in progress on Interface Serial 1"
I suggest to check not only ratio (assymetric routing !),
but high number of SYNs to single host.
- Leonid Yegoshin, LY22
