Daca bag adresa sursa in ipchains cu -j DENY la 2 minute primesc flood de la alta adresa. O bag si pe asta in firewall.. apare alta.. si tot asa Chestia asta m-a facut sa cred ca adresa e spoofata.. Ce zici, gresesc ?
> Pai vad ca vine de la o singura adresa...Cum ai dedus tu ca e syn flood de > la adrese spoofate? > > On Mon, 17 Nov 2003, Bucur Marian wrote: > > > M-ai bagat in ceatza.. cum blochez legaturile astea cu ipchanins? > > Uite si informatiile > > #netstat -tn | grep 80.86.96.67 | wc -l 109 (daca > > las http deschis mai mult nr creste ) > > > > Si un sample de pachet: > > > > 80.86.96.67.32669 > 213.154.138.42.www: S 3969992216:3969992216(0) win 32120 > > <mss 1460,sackOK,timestamp 3640400 838860800,nop,wscale 0> (DF) [tos 0x90] > > (ttl 39, id 4125) > > 16:37:52.766193 > 213.154.138.42.www > 80.86.96.67.32669: S > > 3692341465:3692341465(0) ack 3969992217 win 16060 <mss 1460,sackOK,timestamp > > 18799772 3640400,nop,wscale 0> (DF) (ttl 64, id 36054) > > 80.86.96.67.32675 > 213.154.138.42.www: S 565256024:565256024(0) win 32120 > > <mss 1460,sackOK,timestamp 11292301 1929379840,nop,wscale 0> (DF) [tos 0x90] > > (ttl 39, id 6155) --- Detalii despre listele noastre de mail: http://www.lug.ro/
