A Broadband and ADSL forum. BroadbanterBanter

Welcome to BroadbanterBanter.

You are currently viewing as a guest which gives you limited access to view most discussions and other FREE features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload your own photos and access many other special features. Registration is fast, simple and absolutely free so please, join our community today.

Go Back   Home » BroadbanterBanter forum » Newsgroup Discussions » uk.telecom.broadband (UK broadband)
Site Map Home Register Authors List Search Today's Posts Mark Forums Read Web Partners

uk.telecom.broadband (UK broadband) (uk.telecom.broadband) Discussion of broadband services, technology and equipment as provided in the UK. Discussions of specific services based on ADSL, cable modems or other broadband technology are also on-topic. Advertising is not allowed.

Help! Router failures coinciding with SYN Flood entries in the logs



 
 
Thread Tools Display Modes
  #1  
Old November 23rd 05, 10:03 PM posted to uk.telecom.broadband
Shevek
external usenet poster
 
Posts: 52
Default Help! Router failures coinciding with SYN Flood entries in the logs

All,

Hope someone can help as I am a complete networking noob and this
problem giving me a real headache!

I have a Belkin 7630 (latest firmware, 9/8/2004) connected to f2s on a
static IP which just recently has started to lose connection seemingly
randomly.

Sometimes a disconnect/reconnect solves the problem, sometimes a soft
restart and a couple of times its needed a cold restart to fix it.

It happened again earlier and I had the bright idea to look in the log
(dur!) and discovered that the drop-outs coincided with SYN Flood
entries every time:

11/23/2005 19:59:48 **SYN Flood** x.x.x.x, x- y.y.y.y, y (from ATM1
Inbound)

Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?

A few nights ago it happened repeatedly so many times as to make my
connection unusable. A quick google revealed a post on DSLReports.com
(http://www.dslreports.com/forum/remark,12852792) advising to access
the firewall_spi_h.stm page on the router and change the following
settings from 10 to 11:

Connection Policy Fragmentation half-open wait (I guess it means
this one as it is the only other one set to 10 by default)

and

DoS Detect Criteria Maximum incomplete TCP/UDP sessions number from
same host

Will this actually help...? What else can I do...?

TIA
--

Shevek

iTunesRegistry.com: 4,199 tracks, 2.968 diversity
http://www.itunesregistry.com/ reports/reports.php?showuser=2 011

Get DigiGuide - a downloadable desktop PC TV and Radio Guide
http://getdigiguide.com/?p=1&r =31493

Get Firefox!
http://www.spreadfirefox.com/? q=affiliates&id=8681&t=1
  #2  
Old November 23rd 05, 10:56 PM posted to uk.telecom.broadband
Greg Hennessy
external usenet poster
 
Posts: 85
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Wed, 23 Nov 2005 21:03:37 +0000, Shevek wrote:

All,


11/23/2005 19:59:48 **SYN Flood** x.x.x.x, x- y.y.y.y, y (from ATM1
Inbound)

Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?


I suggest configuring your router to be a good internet citizen and send
back an RST, if its not already.
--
"Access to a waiting list is not access to health care"
  #3  
Old November 23rd 05, 11:33 PM posted to uk.telecom.broadband
Shevek
external usenet poster
 
Posts: 52
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Wed, 23 Nov 2005 21:56:42 +0000, Greg Hennessy
wrote:

On Wed, 23 Nov 2005 21:03:37 +0000, Shevek wrote:

All,


11/23/2005 19:59:48 **SYN Flood** x.x.x.x, x- y.y.y.y, y (from ATM1
Inbound)

Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?


I suggest configuring your router to be a good internet citizen and send
back an RST, if its not already.


erm, what's that then...?!?
--

Shevek

iTunesRegistry.com: 4,199 tracks, 2.968 diversity
http://www.itunesregistry.com/ reports/reports.php?showuser=2 011

Get DigiGuide - a downloadable desktop PC TV and Radio Guide
http://getdigiguide.com/?p=1&r =31493

Get Firefox!
http://www.spreadfirefox.com/? q=affiliates&id=8681&t=1
  #4  
Old November 24th 05, 12:34 AM posted to uk.telecom.broadband
Greg Hennessy
external usenet poster
 
Posts: 85
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Wed, 23 Nov 2005 22:33:11 +0000, Shevek wrote:


Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?


I suggest configuring your router to be a good internet citizen and send
back an RST, if its not already.


erm, what's that then...?!?



It means 'unstealth' your router by configuring it to send back TCP resets
and ICMP unreachables as a response to incoming unwanted connections.

This will politely tell the connecting endpoint to go away rather than just
dropping the connection to the floor.



greg
--
"Access to a waiting list is not access to health care"
  #5  
Old November 24th 05, 01:39 AM posted to uk.telecom.broadband
Shevek
external usenet poster
 
Posts: 52
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Wed, 23 Nov 2005 23:34:43 +0000, Greg Hennessy
wrote:

On Wed, 23 Nov 2005 22:33:11 +0000, Shevek wrote:


Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?

I suggest configuring your router to be a good internet citizen and send
back an RST, if its not already.


erm, what's that then...?!?



It means 'unstealth' your router by configuring it to send back TCP resets
and ICMP unreachables as a response to incoming unwanted connections.

This will politely tell the connecting endpoint to go away rather than just
dropping the connection to the floor.


Is that possible with my Belkin 7630...?



greg

--

Shevek

iTunesRegistry.com: 4,199 tracks, 2.968 diversity
http://www.itunesregistry.com/ reports/reports.php?showuser=2 011

Get DigiGuide - a downloadable desktop PC TV and Radio Guide
http://getdigiguide.com/?p=1&r =31493

Get Firefox!
http://www.spreadfirefox.com/? q=affiliates&id=8681&t=1
  #6  
Old November 24th 05, 11:04 AM posted to uk.telecom.broadband
[email protected]
external usenet poster
 
Posts: 25
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Wed, 23 Nov 2005 21:03:37 +0000, Shevek wrote:

All,

Hope someone can help as I am a complete networking noob and this
problem giving me a real headache!

I have a Belkin 7630 (latest firmware, 9/8/2004) connected to f2s on a
static IP which just recently has started to lose connection seemingly
randomly.


11/23/2005 19:59:48 **SYN Flood** x.x.x.x, x- y.y.y.y, y (from ATM1


I had a similar problem with my 3Com wireless router.
I use eMule and about once a day the router would hang with SYN Flood
message in the log.
On the 3Com I went to the Firewall settings and changed it from
'maximum' to 'minimum' which seems to have stopped the problem.
I think the firewall was being a bit too aggresive in it's checking
and throwing a wobbler when it didn't need to.

(of course I'm now probably blissfully unaware of network intrusions!
- but I do have software firewalls on my PCs anyway)

HTH

  #7  
Old November 24th 05, 11:27 AM posted to uk.telecom.broadband
Greg Hennessy
external usenet poster
 
Posts: 85
Default Help! Router failures coinciding with SYN Flood entries in the logs

On Thu, 24 Nov 2005 00:39:31 +0000, Shevek wrote:

On Wed, 23 Nov 2005 23:34:43 +0000, Greg Hennessy
wrote:

On Wed, 23 Nov 2005 22:33:11 +0000, Shevek wrote:


Now, I know that it is a BitTorrent peer causing the problem due to
the custom port I use but my question is, what can I do about it?

I suggest configuring your router to be a good internet citizen and send
back an RST, if its not already.

erm, what's that then...?!?



It means 'unstealth' your router by configuring it to send back TCP resets
and ICMP unreachables as a response to incoming unwanted connections.

This will politely tell the connecting endpoint to go away rather than just
dropping the connection to the floor.


Is that possible with my Belkin 7630...?


I have no idea, time for you to RTFM.
--
"Access to a waiting list is not access to health care"
 




Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Belkin Wireless Router PSU failures McSpreader uk.telecom.broadband (UK broadband) 17 March 6th 06 11:45 PM
Do BT keep logs of test results? Ian Stirling uk.telecom.broadband (UK broadband) 23 July 4th 05 10:21 PM
PN Fair Usage and Access Logs EC uk.telecom.broadband (UK broadband) 16 February 19th 05 01:45 AM
Plusnet failures Peter uk.telecom.broadband (UK broadband) 1 June 11th 04 09:13 AM
Netgear DG834 v. DG814 Logs Les Desser uk.telecom.broadband (UK broadband) 3 December 29th 03 11:30 AM


All times are GMT +1. The time now is 01:13 AM.


Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2018, Jelsoft Enterprises Ltd.Content Relevant URLs by vBSEO 2.4.0
Copyright 2004-2018 BroadbanterBanter.
The comments are property of their posters.