[linux-cifs-client] CIFS module causing SYN flood?

[Shannon Johnson]

I'm using the 1.17c version of the CIFS module for the 2.4 kernel on
several machines connecting to Samba 3.0.5(pre1) and am seeing some
interesting logs. The server is saying:

 

Jun 18 08:55:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.

Jun 18 08:56:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.

Jun 18 08:57:52 server03 kernel: possible SYN flooding on port 139.
Sending cookies.

Jun 18 08:58:52 server03 kernel: possible SYN flooding on port 139.
Sending cookies.

Jun 18 08:59:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.

 

I checked netstat (netstat -ant | grep SYN_RECV) and this is what it's
showing me (a couple thousand lines):

 

tcp        0      0 192.168.1.5:139       192.168.1.55:43868    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.58:51986    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.62:49830    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.58:34094    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.55:49077    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.62:50651    SYN_RECV


tcp        0      0 192.168.1.5:139       192.168.1.58:36895    SYN_RECV


 

This only happens when the linux clients are being relatively heavily
used (i.e., running code that requires a lot of network traffic). All of
the Windows clients are working fine (although they slow down when the
server is being hit with the SYN flood). I don't think it's a problem
with the server, because if I reboot the linux clients, the flood stops
immediately. I know I'm still using the 1.17c version... I'm waiting the
for 1.17d version to compile right now, but thought I'd send this
message out to see if anybody had any suggestions for me.

 

Shannon

 

____________________________

 

Shannon Johnson

Network Support Specialist / Systems Administrator

Dept. of Mechanical and Nuclear Engineering

224 Reber Building

University Park, PA 16802

Phone: (814) 865-8267

____________________________

 

-------------- next part --------------
HTML attachment scrubbed and removed