"papa" (06-02-25 21:23:00):

> I noticed my data light was very busy today on the port connecting my
> Fedora server to the net. It runs the Apache web server. When I run
> the command netstat I see many connections to port 80 from a whole
> range of addresses from the same subnet. Each one establishes a syc
> connection.
>
> My question is this:
>
> How can I check to see if these packets are originating from my
> machine or if they are 'inbound' and form a syc attack?

In the netstat output, you'll notice that there is a table header with
"Local Address" and "Foreign Address" cells. What exactly do you mean
by "sy[n]c attack"? Do you mean a SYN flood?

Regards.

Yes, I meant SYN Flood.



I am seeing many different IP addresses connecting to port 80, over 100 at a
time, they are all from the same subnet, somewhere in Australia, and I'm in
the UK.



I just wanted to check that it was not my machine making these connections
first.



Papa


"Ertugrul Soeylemez" wrote in message
news:20060226042813.37fff1d4@kill.mine.nu...
> "papa" (06-02-25 21:23:00):
>
>> I noticed my data light was very busy today on the port connecting my
>> Fedora server to the net. It runs the Apache web server. When I run
>> the command netstat I see many connections to port 80 from a whole
>> range of addresses from the same subnet. Each one establishes a syc
>> connection.
>>
>> My question is this:
>>
>> How can I check to see if these packets are originating from my
>> machine or if they are 'inbound' and form a syc attack?
>
> In the netstat output, you'll notice that there is a table header with
> "Local Address" and "Foreign Address" cells. What exactly do you mean
> by "sy[n]c attack"? Do you mean a SYN flood?
>
> Regards.