Is this a sync attack or is my PC send out an attack? - Security

This is a discussion on Is this a sync attack or is my PC send out an attack? - Security ; Hi, I noticed my data light was very busy today on the port connecting my Fedora server to the net. It runs the Apache web server. When I run the command netstat I see many connections to port 80 from ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: Is this a sync attack or is my PC send out an attack?

  1. Is this a sync attack or is my PC send out an attack?

    Hi,



    I noticed my data light was very busy today on the port connecting my Fedora
    server to the net. It runs the Apache web server. When I run the command
    netstat I see many connections to port 80 from a whole range of addresses
    from the same subnet. Each one establishes a syc connection.



    My question is this:



    How can I check to see if these packets are originating from my machine or
    if they are 'inbound' and form a syc attack?



    Many thanks,



    P



  2. Re: Is this a sync attack or is my PC send out an attack?

    "papa" (06-02-25 21:23:00):

    > I noticed my data light was very busy today on the port connecting my
    > Fedora server to the net. It runs the Apache web server. When I run
    > the command netstat I see many connections to port 80 from a whole
    > range of addresses from the same subnet. Each one establishes a syc
    > connection.
    >
    > My question is this:
    >
    > How can I check to see if these packets are originating from my
    > machine or if they are 'inbound' and form a syc attack?


    In the netstat output, you'll notice that there is a table header with
    "Local Address" and "Foreign Address" cells. What exactly do you mean
    by "sy[n]c attack"? Do you mean a SYN flood?

    Regards.

  3. Re: Is this a sync attack or is my PC send out an attack?

    Yes, I meant SYN Flood.



    I am seeing many different IP addresses connecting to port 80, over 100 at a
    time, they are all from the same subnet, somewhere in Australia, and I'm in
    the UK.



    I just wanted to check that it was not my machine making these connections
    first.



    Papa


    "Ertugrul Soeylemez" wrote in message
    news:20060226042813.37fff1d4@kill.mine.nu...
    > "papa" (06-02-25 21:23:00):
    >
    >> I noticed my data light was very busy today on the port connecting my
    >> Fedora server to the net. It runs the Apache web server. When I run
    >> the command netstat I see many connections to port 80 from a whole
    >> range of addresses from the same subnet. Each one establishes a syc
    >> connection.
    >>
    >> My question is this:
    >>
    >> How can I check to see if these packets are originating from my
    >> machine or if they are 'inbound' and form a syc attack?

    >
    > In the netstat output, you'll notice that there is a table header with
    > "Local Address" and "Foreign Address" cells. What exactly do you mean
    > by "sy[n]c attack"? Do you mean a SYN flood?
    >
    > Regards.




+ Reply to Thread