[92122] in North American Network Operators' Group
Re: TCP receive window set to 0; DoS or not?
daemon@ATHENA.MIT.EDU (Christopher L. Morrow)
Thu Sep 7 20:26:01 2006
Date: Fri, 08 Sep 2006 00:24:53 +0000 (GMT)
From: "Christopher L. Morrow" <christopher.morrow@verizonbusiness.com>
In-reply-to: <Pine.LNX.4.64.0609071620240.16390@pegasus.billn.net>
To: billn@billn.net
Cc: Joshua Brewer <jbrewer@brandxnet.com>,
Travis Hassloch <travis.hassloch@rackspace.com>, nanog@merit.edu
Errors-To: owner-nanog@merit.edu
On Thu, 7 Sep 2006 billn@billn.net wrote:
>
> On Thu, 7 Sep 2006, Joshua Brewer wrote:
>
> > What about when we're seeing this on port 25?
>
> Sand worms.
>
> In all seriousness, your guess is as good as mine, at that point. If
> memory serves, the platforms we saw this on most, with web browsers, were
> mobile devices. What kind of volume are you seeing this in?
I see this on web, ftp, rsync as well... so perhaps it's just impolite
people? :)
