6.8.2014 1.59, Paul Stewart kirjoitti: > Hi there… > > Today, we started getting hit with DDOS attacks specifically against our > CentOS mirror. Has anyone else seen this behavior before? > > These are TCP SYN and TCP RST misuse type attacks. I don't run a mirror myself, but please note that what you're seeing might be simply yum-plugin-fastestmirror doing what's it's supposed to do. yum-plugin-fastestmirror determines the closest mirror by opening a TCP connection to each mirror and then closing the connection immediately. The time spent is measured, and the fastest mirror as determined by this process gets selected.