Bitcoin Forum
December 08, 2016, 04:30:52 AM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: someone is syn flooding clients  (Read 1837 times)
NghtRppr
Sr. Member
****
Offline Offline

Activity: 476


View Profile
June 22, 2011, 10:37:22 PM
 #1

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481171452
Hero Member
*
Offline Offline

Posts: 1481171452

View Profile Personal Message (Offline)

Ignore
1481171452
Reply with quote  #2

1481171452
Report to moderator
ius
Jr. Member
*
Offline Offline

Activity: 56


View Profile
June 22, 2011, 10:40:20 PM
 #2

And you're absolutely sure it isn't due to the multitude of peers trying to connect to you? Wink

PGP: 0xCC06E446 Bitcoin: 19kdfgW1KXQgV7SCLEPAojtHxN9xotGkGH
NghtRppr
Sr. Member
****
Offline Offline

Activity: 476


View Profile
June 22, 2011, 10:44:00 PM
 #3

And you're absolutely sure it isn't due to the multitude of peers trying to connect to you? Wink

It's never triggered it before but no I'm not sure.
btc_man
Newbie
*
Offline Offline

Activity: 13


View Profile
June 22, 2011, 11:19:40 PM
 #4

are they to/from an ip you know?
phorensic
Hero Member
*****
Offline Offline

Activity: 630



View Profile
June 22, 2011, 11:43:17 PM
 #5

I would say it's the p2p nature of the client downloading blocks that is setting off your firewall.  It will use a lot of connections if you let it run for a while.
zer0
Sr. Member
****
Offline Offline

Activity: 350



View Profile
June 23, 2011, 01:10:30 AM
 #6

i run bitcoind over Tor seems the best way to prevent floods or somebody finding it
JoelKatz
Legendary
*
Offline Offline

Activity: 1386


Democracy is vulnerable to a 51% attack.


View Profile WWW
June 23, 2011, 01:18:28 AM
 #7

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.
If it goes away in a few minutes, it's probably completely normal. The client wants to be well-connected as quickly as possible and this may set off attack warnings on some systems.

If someone has a chance, it would be helpful to run the client on a machine that is monitored for traffic and connection volume. At least count SYNs to the bitcoin port. Ideally, use the IP for nothing else for awhile and log *all* traffic to it to see if you get probes, attack attempts, and the like. Post your summarized statistical results so we can have a baseline for what's normal. If nobody else does this, I'll try to do it myself tomorrow sometime.

I am an employee of Ripple.
1Joe1Katzci1rFcsr9HH7SLuHVnDy2aihZ BM-NBM3FRExVJSJJamV9ccgyWvQfratUHgN
bitcoinBull
Legendary
*
Offline Offline

Activity: 826


rippleFanatic


View Profile
June 23, 2011, 01:54:44 AM
 #8

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.
If it goes away in a few minutes, it's probably completely normal. The client wants to be well-connected as quickly as possible and this may set off attack warnings on some systems.

If someone has a chance, it would be helpful to run the client on a machine that is monitored for traffic and connection volume. At least count SYNs to the bitcoin port. Ideally, use the IP for nothing else for awhile and log *all* traffic to it to see if you get probes, attack attempts, and the like. Post your summarized statistical results so we can have a baseline for what's normal. If nobody else does this, I'll try to do it myself tomorrow sometime.

Would be quite helpful if somebody(s) set up several honeypots and left them connected to the network, reporting the results periodically.  There are downloadable honeypot configurations that should make this easy enough.

College of Bucking Bulls Knowledge
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!