0

My server (http://monitor.wingify.com/munin/visualwebsiteoptimizer.com/app.visualwebsiteoptimizer.com.html) recently had an outrage. One of the suspecious things I found was loads of SYN flooding messages in /var/log/messages

Feb  8 15:17:34 app kernel: possible SYN flooding on port 80. Sending cookies.
Feb  8 15:36:58 app -- MARK --

There are loads of SYN flooding errors and loads of -- MARK -- entries. What does this mean. Any correlation of data in munin graphs and this SYN flooding error that I should be aware / cautious about.

How can I fix this and what could be the possible error

Thanks

Sparsh Gupta
  • 1,127
  • 7
  • 21
  • 31

1 Answers1

0

The --MARK-- entries are harmless, they are a result of the syslog mark feature being enabled, and just provide regular timestamps in the logfiles so that, if things are quiet, you can be sure that syslog is still writing.

I'm afraid I can't comment on the syn flooding entries, which are indeed interesting. Hopefully someone else can shed light on those.

Sparsh, if I might comment, you've now asked eight questions on serverfault, and accepted no answers. The local etiquette is that when you're happy with an answer, you accept it, by clicking on the tick outline (if memory serves); that drives the reputation system. Of course, you might really not be happy with any of the answers offered to any of your questions, and if that's so then I apologise. But we see a red "0% accept rate" warning by your username, and that often deters people from answering your questions. You might want to spend a little time going back through your previous questions, and accepting the most satisfactory answer for each one.

MadHatter
  • 79,770
  • 20
  • 184
  • 232
  • 2
    Thanks for letting me know about the accepting system. I was completely unaware of it. I will review all my questions and answers now – Sparsh Gupta Feb 08 '11 at 17:32
  • 1
    Sparsh: thank you for taking the pointer so graciously, and I'm glad to help. Sorry not to have a knowledgable answer about SYN cookies. – MadHatter Feb 08 '11 at 17:49
  • Part of the troubleshooting process in this case would be to set up a packet capture on the host in question and verify whether or not there is SYN flooding going on. – joeqwerty Feb 08 '11 at 22:35