Possible SYN flooding on port 2101

[regina.operation@…]

Hello,

A lot of client on our ntripcaster professional (version 2.031) observed a lot of disconnection during 20 minutes.
On the different log of the ntripcaster we saw only many disconnections (but not all the connections, maybe 60% of disconnections). There is no more connections from clients or sources which let thinking to a saturation of the 2101 port.
We thinking on an attack but the analyses done by the network team said that there was no attack.
A system analysis was done also, but the différent limits wasn't reach by the system.
So we suspect an issue on the ntripcaster, Have you ever seen this behavior ?

[stoecker]

Without further information I can't say much about this.

You say that "différent limits" were not reached: Is the max_clients setting high enough to handle the connects you're getting?

[anonymous]

Hello,

In fact I talk about the limits of the system and not the software :
Number of the socket : we saw a deacrease of the number of the sockets during the failure
Traffic : we saw a deacrease during the failure which mean that it could not be an attack on our system.
Number of Process : we saw an increase of the number of process just after the failure (We suppose that it could be link to the number of reconnection of clients on the ntripcaster)
CPU : only 5% used of CPU
Concerniing the software we never reach the limits in terms of max_clients. We observed a deacrease of the number of clients during this failure.

[stoecker]

Well, as the caster does not spawn new processes, but ony uses threads and your saw increased number of processes I think that the reason of the trouble was not the caster itself.

Aynway for this issue I can't help.

If you have an indication the caster has a fault please open another ticket.