[TriLUG] SYN Flood?

[jason at monsterjam.org]

we need more details. are you by any chance using your schools DNS server for DNS?
SYN from from where? to where? what port(s)?

etc.

Jason


On Fri, Jan 19, 2007 at 11:01:57PM -0500, MG wrote:
> Hello, all,
> 
> I'm new here <waves> and just came across something fairly scary.   My  
> home router shows  something  called an IP Fragmented Packet *from my 
> school's DNS server*, then there's a series of LAN-side SYN Flood, then 
> just plain SYN Flood, events to and from my [innocent, I swear!] 
> router's IP to some address in Atlanta, back from Atlanta, then to a 
> rival school's IP address here.
> 
> My systems are XP and Debian 2.6 - when I shut down the XP, it jumped to 
> the Debian.   Can anyone clue me into wth's going on?
> 
> Many thanks -
> 
> MG
> -- 
> TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
> TriLUG Organizational FAQ  : http://trilug.org/faq/
> TriLUG Member Services FAQ : http://members.trilug.org/services_faq/

-- 
================================================
|    Jason Welsh   jason at monsterjam.org        |
| http://monsterjam.org    DSS PGP: 0x5E30CC98 |
|    gpg key: http://monsterjam.org/gpg/       |
================================================