Greg,
It is CPMAD that tell you it sees a land attack. Check the
cpmad_config.conf
file (in $FWDIR/conf) and you should find line containing _land_attck_ in
it.
A land attack sends out just one SYN packet in which the sending device
IP
address has been replaced with the address of the destination, meaning that
it
tries to answer to it's own, resulting in loop backed packets ... slowing
down
the server.
Met vriendelijke groeten - Bien � vous - Kind regards
Guy ROELANDTS
EMEA GS Internet Expertise Centre - CCSA & CCSE
Compaq Software Engineer - Belgium
E-mail : [EMAIL PROTECTED]
Tel: +32(02)729.77.44 (options 3 - 3 - 1)
Fax: +32(02)729.77.65
=====================================================================
This message may contain confidential and/or proprietary information,
and is intended only for the person/entity to whom it was originally
addressed. The content of this message may contain private views and
opinions which do not constitute a formal disclosure or commitment
unless specifically stated. Should you receive this message by mistake
please inform the sender immediately.
=====================================================================
-----Original Message-----
From: Greg Polanski [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, September 05, 2001 5:55 PM
To: Firewall One List
Subject: [FW1] attack=land_attack
What does this mean?
daemon alert product MAD proto ip additionals: attack=land_attack
--
_______________________________________________________________
Greg Polanski mailto:[EMAIL PROTECTED]
ADC Telecommunications, Inc. 952.917.0548
MS 36 952.917.0651 FAX
PO Box 1101 612.309.4493 cell/pager
Minneapolis, MN 55440-1101 [EMAIL PROTECTED]
_______________________________________________________________
============================================================================
====
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
============================================================================
====
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
