[linux-cifs-client] CIFS module causing SYN flood?
Shannon Johnson
sjohnson at engr.psu.edu
Fri Jun 18 13:18:34 GMT 2004
I'm using the 1.17c version of the CIFS module for the 2.4 kernel on
several machines connecting to Samba 3.0.5(pre1) and am seeing some
interesting logs. The server is saying:
Jun 18 08:55:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.
Jun 18 08:56:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.
Jun 18 08:57:52 server03 kernel: possible SYN flooding on port 139.
Sending cookies.
Jun 18 08:58:52 server03 kernel: possible SYN flooding on port 139.
Sending cookies.
Jun 18 08:59:52 server03 kernel: possible SYN flooding on port 445.
Sending cookies.
I checked netstat (netstat -ant | grep SYN_RECV) and this is what it's
showing me (a couple thousand lines):
tcp 0 0 192.168.1.5:139 192.168.1.55:43868 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.58:51986 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.62:49830 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.58:34094 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.55:49077 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.62:50651 SYN_RECV
tcp 0 0 192.168.1.5:139 192.168.1.58:36895 SYN_RECV
This only happens when the linux clients are being relatively heavily
used (i.e., running code that requires a lot of network traffic). All of
the Windows clients are working fine (although they slow down when the
server is being hit with the SYN flood). I don't think it's a problem
with the server, because if I reboot the linux clients, the flood stops
immediately. I know I'm still using the 1.17c version... I'm waiting the
for 1.17d version to compile right now, but thought I'd send this
message out to see if anybody had any suggestions for me.
Shannon
____________________________
Shannon Johnson
Network Support Specialist / Systems Administrator
Dept. of Mechanical and Nuclear Engineering
224 Reber Building
University Park, PA 16802
Phone: (814) 865-8267
____________________________
-------------- next part --------------
HTML attachment scrubbed and removed
More information about the linux-cifs-client
mailing list