[CentOS] SYD flood dropped on Sendmail (centos 4.x)

Thu Nov 20 20:07:03 UTC 2008
Les Mikesell <lesmikesell at gmail.com>

Kai Schaetzl wrote:
> Chris Heiner wrote on Thu, 20 Nov 2008 08:48:50 -0800:
> 
>> My firewall seems to block an attack my Centos / Sendmail boxes on port 110.
> 
> port 110 is your POP server, probably dovecot.
> 
>> These servers require a reboot after each attack.
> 
> Because of what?
> 
>> My firewall says it's
>> blocked?
> 
> I don't see this statement in your logs. How/where does it say this?
> 
>> Do I need to patch something on sendmail? Or is my firewall not
>> doing its job (Sonicwall)? This is not the first time this has happened.
> 
> SYN floods are not unusual, even if it is not an attack. 
> What or if you want to do something depends on your situation.

If you have a popular server you can get what appear to be syn floods 
from broken asymmetrical routing or bad firewall settings that permit 
what would ordinarily be a normal number of client connection requests 
to reach you but keep your response from getting back.  So the clients 
sit and retry, hammering you with syn's.

-- 
   Les Mikesell
    lesmikesell at gmail.com