Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
SSh connections
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
deathiv
n00b
n00b


Joined: 30 May 2012
Posts: 11

PostPosted: Wed Dec 12, 2012 2:58 am    Post subject: SSh connections Reply with quote

I have a gentoo server, and recently my network has been running very slowly. I tried many things and one of them was to use netstat to see what traffic was coming in.

It's been going for 2 hours now and no end in site of the thousands of lines that read tcp 0 0/1 livecd:<port> ip:ssh syn_sent/Established

Is this something to be worried about and what does it mean?
Back to top
View user's profile Send private message
albright
Advocate
Advocate


Joined: 16 Nov 2003
Posts: 2119
Location: Near Toronto

PostPosted: Wed Dec 12, 2012 3:03 am    Post subject: Reply with quote

It is said this is a symptom of denial of service attack.
does that make sense in your situation?

this site seems to have good advice:

http://nazeems.wordpress.com/2012/09/08/ddos-attack-measures/
_________________
.... there is nothing - absolutely nothing - half so much worth
doing as simply messing about with Linux ...
(apologies to Kenneth Graeme)
Back to top
View user's profile Send private message
deathiv
n00b
n00b


Joined: 30 May 2012
Posts: 11

PostPosted: Wed Dec 12, 2012 3:11 am    Post subject: Reply with quote

Yup, those symptoms fit, but as to why that happened I don't know, it seemed to stop when I rebooted, but if It starts up again I'll try to follow that guide.
Back to top
View user's profile Send private message
Hu
Watchman
Watchman


Joined: 06 Mar 2007
Posts: 9127

PostPosted: Thu Dec 13, 2012 2:18 am    Post subject: Reply with quote

Did your reboot change your IP address? If so, the attack is now hitting someone else.
Back to top
View user's profile Send private message
deathiv
n00b
n00b


Joined: 30 May 2012
Posts: 11

PostPosted: Thu Dec 13, 2012 8:31 pm    Post subject: Reply with quote

IP's static. I changed some of the settings and am probably going to reassign SSHD to run on a different port than 22 so that the connections don't find the port.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum