topic Syn flood in Full Fibre

Syn flood

Monsoft — Wed, 19 Nov 2025 15:11:40 GMT

I recently noticed that I see a lots of syn packages coming to my router from multiple IP addresses located in Brazil.
Based on my knowledge it's looks like syn flood attack.
I have a few firewall rules added (rate limiting and geo ip blocking) which are helping me to mitigate this kind of network activity so I should be fine, but what I'm curious is this is only me experiencing this kind of traffic or this is some more global campaign across Plusnet network ?

Currently, traffic comes from subnet 45.225.192.0/22 (via AS266948) unless these IPs are spoofed.

Re: Syn flood

jab1 — Wed, 19 Nov 2025 15:10:59 GMT

You get this kind of thing from time to time . The Hub should take care of it.

Re: Syn flood

Monsoft — Wed, 19 Nov 2025 15:14:03 GMT

I use my own router with OpenWrt system so I have no issue with handling this kind of traffic. I'm only curious if this is only my currently getting this traffic or more people experiencing this.

Re: Syn flood

jab1 — Wed, 19 Nov 2025 16:57:50 GMT

Fair enough. I get spells of it, and I'm not with PN, but I see it on a regular basis on most log files I look at.