Anyone know about SYN flood attacks

[Lost User]

and how to combat them? I have a PIX firewall. I was getting a few SYN flood attacks. Now, I changed the port that my application uses. Is there a way to counter SYN flood attacks? Microsoft talks about a registry value that can be changed; but a bit of googling shows complaints of OS crashes, when that feature is enabled. I could not find any ref for that in MSDN to find whether it is fixed. Thomas My article on a reference-counted smart pointer that supports polymorphic objects and raw pointers

[Anders Molin]

Most firewalls can handle SYN attacks, and AFAIK Win2k and XP also handle then quite well. There is really not much you can do about SYN attacks. It's an easy to use attack, and easy to spoof the ip of the attacker. If you wanna know the details of a SYN Flood just let me know ;) - Anders Money talks, but all mine ever says is "Goodbye!"

[Lost User]

My firewall is letting all the SYNs through, and I do not know how to handle it. I wanted to turn on the SYN protection feature on Windows 2000; but all these people who talk abot crashing servers make me nervous about turning it on. :-) The last thing I need now is a crash. Btw, I know the theory part of SYN flood. It is the practical part of what to do when it occurs that I am trying to figure out. Thomas My article on a reference-counted smart pointer that supports polymorphic objects and raw pointers

[Joao Vaz]

Syn Floods could be caused by ICMP and IGMP packets , disable these two protocols , you normally don't need them after all. Cheers,Joao Vaz And if your dream is to care for your family, to put food on the table, to provide them with an education and a good home, then maybe suffering through an endless, pointless, boring job will seem to have purpose. And you will realize how even a rock can change the world, simply by remaining obstinately stationary.-Shog9 Remember just because a good thing comes to an end, doesn't mean that the next one can't be better.-Chris Meech

[Anders Molin]

No no, SYN is always TCP. The TCP handshake is the whole idea behind the attack. There's no SYN/SYNACK packages in ICMP. - Anders Money talks, but all mine ever says is "Goodbye!"

[Joao Vaz]

Oops , my fault ,you're right, I was confusing it with Ping of Death/ICMP/Smurf/Fraggle/TearDrop and whatsover variations of flooding that exists :rolleyes: Cheers,Joao Vaz And if your dream is to care for your family, to put food on the table, to provide them with an education and a good home, then maybe suffering through an endless, pointless, boring job will seem to have purpose. And you will realize how even a rock can change the world, simply by remaining obstinately stationary.-Shog9 Remember just because a good thing comes to an end, doesn't mean that the next one can't be better.-Chris Meech

[thematt]

The SYN attacks probably have spoofed source ip addresses. You should be blocking these (private addresses) if you are not already. Matt is a network administrator for an auditing company in the midwest. He is shamelessly looking for Windows programming side work.