Opened 3 years ago
Closed 3 years ago
#121 closed defect (worksforme)
Possible SYN flooding on port 2101
|Reported by:||Owned by:|
A lot of client on our ntripcaster professional (version 2.031) observed a lot of disconnection during 20 minutes.
On the different log of the ntripcaster we saw only many disconnections (but not all the connections, maybe 60% of disconnections). There is no more connections from clients or sources which let thinking to a saturation of the 2101 port.
We thinking on an attack but the analyses done by the network team said that there was no attack.
A system analysis was done also, but the différent limits wasn't reach by the system.
So we suspect an issue on the ntripcaster, Have you ever seen this behavior ?
Change History (3)
comment:1 by , 3 years ago
|Status:||new → needinfo|
comment:2 by , 3 years ago
In fact I talk about the limits of the system and not the software :
Number of the socket : we saw a deacrease of the number of the sockets during the failure
Traffic : we saw a deacrease during the failure which mean that it could not be an attack on our system.
Number of Process : we saw an increase of the number of process just after the failure (We suppose that it could be link to the number of reconnection of clients on the ntripcaster)
CPU : only 5% used of CPU
Concerniing the software we never reach the limits in terms of max_clients. We observed a deacrease of the number of clients during this failure.
comment:3 by , 3 years ago
|Status:||needinfo → closed|
Well, as the caster does not spawn new processes, but ony uses threads and your saw increased number of processes I think that the reason of the trouble was not the caster itself.
Aynway for this issue I can't help.
If you have an indication the caster has a fault please open another ticket.
Without further information I can't say much about this.
You say that "différent limits" were not reached: Is the max_clients setting high enough to handle the connects you're getting?