Opened 3 years ago

Closed 3 years ago

#121 closed defect (worksforme)

Possible SYN flooding on port 2101

Reported by: regina.operation@… Owned by: regina.operation@…
Priority: major Component: Professional Caster
Version: Keywords:



A lot of client on our ntripcaster professional (version 2.031) observed a lot of disconnection during 20 minutes.
On the different log of the ntripcaster we saw only many disconnections (but not all the connections, maybe 60% of disconnections). There is no more connections from clients or sources which let thinking to a saturation of the 2101 port.
We thinking on an attack but the analyses done by the network team said that there was no attack.
A system analysis was done also, but the différent limits wasn't reach by the system.
So we suspect an issue on the ntripcaster, Have you ever seen this behavior ?

Attachments (0)

Change History (3)

comment:1 by stoecker, 3 years ago

Owner: changed from stoecker to regina.operation@…
Status: newneedinfo

Without further information I can't say much about this.

You say that "différent limits" were not reached: Is the max_clients setting high enough to handle the connects you're getting?

comment:2 by anonymous, 3 years ago


In fact I talk about the limits of the system and not the software :
Number of the socket : we saw a deacrease of the number of the sockets during the failure
Traffic : we saw a deacrease during the failure which mean that it could not be an attack on our system.
Number of Process : we saw an increase of the number of process just after the failure (We suppose that it could be link to the number of reconnection of clients on the ntripcaster)
CPU : only 5% used of CPU
Concerniing the software we never reach the limits in terms of max_clients. We observed a deacrease of the number of clients during this failure.

comment:3 by stoecker, 3 years ago

Resolution: worksforme
Status: needinfoclosed

Well, as the caster does not spawn new processes, but ony uses threads and your saw increased number of processes I think that the reason of the trouble was not the caster itself.

Aynway for this issue I can't help.

If you have an indication the caster has a fault please open another ticket.

Modify Ticket

Change Properties
as closed The owner will remain regina.operation@….
The resolution will be deleted. Next status will be 'reopened'.

Add Comment

E-mail address and name can be saved in the Preferences .
Note: See TracTickets for help on using tickets.