My server (http://monitor.wingify.com/munin/visualwebsiteoptimizer.com/app.visualwebsiteoptimizer.com.html) recently had an outrage. One of the suspecious things I found was loads of SYN flooding messages in /var/log/messages
Feb 8 15:17:34 app kernel: possible SYN flooding on port 80. Sending cookies.
Feb 8 15:36:58 app -- MARK --
There are loads of SYN flooding errors and loads of — MARK — entries. What does this mean. Any correlation of data in munin graphs and this SYN flooding error that I should be aware / cautious about.
How can I fix this and what could be the possible error
Thanks
The –MARK– entries are harmless, they are a result of the syslog mark feature being enabled, and just provide regular timestamps in the logfiles so that, if things are quiet, you can be sure that syslog is still writing.
I’m afraid I can’t comment on the syn flooding entries, which are indeed interesting. Hopefully someone else can shed light on those.
Sparsh, if I might comment, you’ve now asked eight questions on serverfault, and accepted no answers. The local etiquette is that when you’re happy with an answer, you accept it, by clicking on the tick outline (if memory serves); that drives the reputation system. Of course, you might really not be happy with any of the answers offered to any of your questions, and if that’s so then I apologise. But we see a red “0% accept rate” warning by your username, and that often deters people from answering your questions. You might want to spend a little time going back through your previous questions, and accepting the most satisfactory answer for each one.
Check more discussion of this question.