cancel
Showing results for 
Search instead for 
Did you mean: 

Syn flood

Monsoft
Grafter
Posts: 28
Thanks: 4
Registered: ‎29-09-2019

Syn flood

I recently noticed that I see a lots of syn packages coming to my router from multiple IP addresses located in Brazil.
Based on my knowledge it's looks like syn flood attack.
I have a few firewall rules added (rate limiting and geo ip blocking) which are helping me to mitigate this kind of network activity so I should be fine, but what I'm curious is this is only me experiencing this kind of traffic or this is some more global campaign across Plusnet network ?


Currently, traffic comes from subnet 45.225.192.0/22 (via AS266948) unless these IPs are spoofed. 

3 REPLIES 3
jab1
The Full Monty
Posts: 22,751
Thanks: 7,955
Fixes: 334
Registered: ‎24-02-2012

Re: Syn flood

You get this kind of thing from time to time . The Hub should take care of it.

John
Monsoft
Grafter
Posts: 28
Thanks: 4
Registered: ‎29-09-2019

Re: Syn flood

I use my own router with OpenWrt system so I have no issue with handling this kind of traffic. I'm only curious if this is only my currently getting this traffic or more people experiencing this.

jab1
The Full Monty
Posts: 22,751
Thanks: 7,955
Fixes: 334
Registered: ‎24-02-2012

Re: Syn flood

Fair enough. I get spells of it, and I'm not with PN, but I see it on a regular basis on most log files I look at. 

John