someone is syn flooding clients

[NghtRppr]

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.

[1713969170]

1713969170

[1713969170]

1713969170

[1713969170]

1713969170

[1713969170]

1713969170

[ius]

And you're absolutely sure it isn't due to the multitude of peers trying to connect to you?

[NghtRppr]

And you're absolutely sure it isn't due to the multitude of peers trying to connect to you?

It's never triggered it before but no I'm not sure.

[btc_man]

are they to/from an ip you know?

[phorensic]

I would say it's the p2p nature of the client downloading blocks that is setting off your firewall.  It will use a lot of connections if you let it run for a while.

[zer0]

i run bitcoind over Tor seems the best way to prevent floods or somebody finding it

[JoelKatz]

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.

If it goes away in a few minutes, it's probably completely normal. The client wants to be well-connected as quickly as possible and this may set off attack warnings on some systems.

If someone has a chance, it would be helpful to run the client on a machine that is monitored for traffic and connection volume. At least count SYNs to the bitcoin port. Ideally, use the IP for nothing else for awhile and log *all* traffic to it to see if you get probes, attack attempts, and the like. Post your summarized statistical results so we can have a baseline for what's normal. If nobody else does this, I'll try to do it myself tomorrow sometime.

[bitcoinBull]

I recently launched the client on my school's network and I got a bunch of syn flood attack warnings.

If it goes away in a few minutes, it's probably completely normal. The client wants to be well-connected as quickly as possible and this may set off attack warnings on some systems.

If someone has a chance, it would be helpful to run the client on a machine that is monitored for traffic and connection volume. At least count SYNs to the bitcoin port. Ideally, use the IP for nothing else for awhile and log *all* traffic to it to see if you get probes, attack attempts, and the like. Post your summarized statistical results so we can have a baseline for what's normal. If nobody else does this, I'll try to do it myself tomorrow sometime.

Would be quite helpful if somebody(s) set up several honeypots and left them connected to the network, reporting the results periodically.  There are downloadable honeypot configurations that should make this easy enough.