Possible SYN flooding on port 443. Sending cookies.

I have an older mobility server. 221 users. Version 1.2.4 build 966. Its on SLES 11 sp1. Also a bit dated. Early in the morning Saturday the server...

I have a working GroupWise Mobility service, but recently had to change
the SSL certificate, because the validity of the previous expired....

Similar Messages

Syn flood attack?

Hello,
I work in an organization in which there is an automatic monitoring of network connections. Yesterday I had a notification of a possible syn flood attack originated by my Mac targeting an IP address (and port: 8000) that I found out to be associated to an internet radio. I did some network monitoring and I found out that with iTunes closed there were no packets with that IP as destination address... has anyone experinced such a problem?
Sincerely
Giuseppe

Arumugam,
We've been having similar issue regarding SYN flood alerts. The affected system in turn starts to send additional ACK requests. This results in issues with the IIS functionality on that server. Clients begin to no longer have the ability to access the site hosted on the server. We've been battling between Cisco and Microsoft on this one. The issue appears to have started around Patch Tuesday in February.
My question to you is this: Have you noticed any latency with the system that is reporting the SYN flood? I'm curious if the problem is local to us, or possibly wide spread.

Port 443 Open

When I run Shields Up port scan test from Gibson Research (www.grc.com) it shows port 443 as being open. I haven't opened port 443. Why is it open on my WRT54G?

First of all, please state the make and exact model number of your modem. If you are using a "modem-router", rather than a true modem, Gibson's "Shields UP!" will scan the ports on your modem-router, not the ports on your WRT54G.
An "open" port is one that is listening to the Internet, waiting for another computer to try to communicate with it. Ordinary home users don't need this, so ports are generally left closed (stealth).
Port 443 is generally used for secure transmissions. It would normally only need to be "open" if you wanted another computer on the Internet to be able to securely call your router (or computer). This is typically used by businesses that want to establish a secure VPN (virtual private network) connection, to connect two branches of their business together, router to router.
Note that port 443 does not need to be left "open" for ordinary Internet connections, including connections to a secured server (https: connection).
By default, all ports on your WRT54G should be closed (i.e. stealth). However, if you have UPnP set to "enabled", then any computer program running on your computer can open a port on your router. This is often the cause for "open ports" on the router. Several types of programs like to open ports on the router. These include Internet games, video conferencing software, peer-to-peer (P2P) software, and computer viruses.
If you don't know of any programs on your computer that need to open ports, in the router, set UPnP to "disabled", and see if that corrects your problem.
One other possible cause for this port 443 problem, is a firmware bug. Some early versions of the RVS4000 firmware had this bug, but the bug was later fixed. I have not heard of this bug appearing in WRT54G firmware. What version of the router do you have? Also, are you running a server (web site or game site) ?
Message Edited by toomanydonuts on 08-02-2008 05:21 AM

Is it possible to create a virtual TCP port and send data to it?

Is it possible to create a virtual TCP port and send data to it?
My application is this: I am reading a constant stream of waveform data from a device via a LabVIEW VI set and I need to get that streaming data to a .NET application. I can poll a TCP port in .NET easily so is there a way I can create a virtual TCP port in LabVIEW and send the data there?

Have a look at the example called simple data server and simple data client and see what you can get from that. I'm not really familiar with TCP myself.
Joe.
"NOTHING IS EVER EASY"

Port 443 content rule, can the CSS see inside the cookie ?

Hi Gilles/everyone,
With a content rule using port 443, can we use cookie based stickiness or is the cookie also encrpyted ?
cheers,
Mike

also encrypted.
No way to see it without an SSL module to decrypt.
Gilles.

Forefront TMG detected a possible SYN attack and will protect the network accordingly

Hi , Some times here internet is not working for using through TMG 2010. but Local Host Internet is working. then it should restart the
Microsoft Forefront TMG Control with related Services. then again users can access the Internet through TMG.
I check the Event Viewer in Server. it shows below Error Log.
Forefront TMG detected a possible SYN attack and will protect the network accordingly
what should for this ?
Regards, COMDINI

Hello,
An offending host attempts to flood Forefront TMG with half-open TCP connections by sending numerous TCP SYN messages to a Forefront TMG server and not completing the TCP handshake, leaving the TCP connections half-open.
Please enable logging to identified this hosts and then check if it is infected by viruses or malware programs.
Please see the value of the number of Maximum half-open TCP connections in Flood Mitigation settings for more information.
Once your problem is solved, you have to see "Forefront TMG is no longer experiencing a SYN attack." message.
This
posting is provided "AS IS" with no warranties or guarantees , and confers no rights.
Microsoft Student Partner 2010
/ 2011
Microsoft Certified Professional
Microsoft Certified Systems Administrator:
Security
Microsoft Certified Systems Engineer:
Security
Microsoft Certified Technology Specialist:
Windows Server 2008 Active Directory, Configuration
Microsoft Certified Technology Specialist:
Windows Server 2008 Network Infrastructure, Configuration
Microsoft Certified Technology Specialist:
Windows Server 2008 Applications Infrastructure, Configuration
Microsoft Certified Technology Specialist:
Windows 7, Configuring
Microsoft Certified IT Professional: Enterprise
Administrator
Microsoft Certified IT Professional: Server Administrator
Microsoft Certified Trainer

SYN flood attack log In CSA MC

I got an SYN flood attack log in CSA MC
CSA log: TESTMODE: A potential SYN Flood attack has been detected. This may also indicate a possible routing problem. Reason: The TCP Listen Queue is full using interface Wired\HP NC7781 Gigabit Server Adapter #2. TCP: CSA MC IP/5401->local Instance IP/4418, flags 0x12. The operation would have been denied.
(Note: In log I have specified CSA MC IP and local Instance IP instead of its IP address)
I understood that SYN flooding is a type of denial of service attack and this alert has occured when a TCP/IP connection was requested by MC to the Instance. It has resulted in a half open connection, as the return address that is not in use. MC has detected it and it got denied.
Please let me know what action I have to take at tins point?
Thanks
Arumugam.K

Arumugam,
We've been having similar issue regarding SYN flood alerts. The affected system in turn starts to send additional ACK requests. This results in issues with the IIS functionality on that server. Clients begin to no longer have the ability to access the site hosted on the server. We've been battling between Cisco and Microsoft on this one. The issue appears to have started around Patch Tuesday in February.
My question to you is this: Have you noticed any latency with the system that is reporting the SYN flood? I'm curious if the problem is local to us, or possibly wide spread.

Assignment IDX1 port to sender idoc adapter ...

Hi gurus,
I have a big problem and I don't have any idea how to solve it. Please, help me.
I have a non-SAP system, regular SAP ERP and SAP XI and I need to transfer IDocs between them.
There is no problem to send IDoc from ERP to XI and forward it to non-SAP system. Unfortunatelly communication in opposite direction doesn't work. XI is not able to receive IDoc sent from non-SAP system because appropriate metadata can not be found in IDX2 cache.
In configuration of communication channel for sending IDocs to non-SAP (receiver idoc adapter) I selected IDX1 port that is directed to the ERP and it's worknig fine. I can send IDoc from XI to non-SAP.
But in configuration of communication channel for receiving IDocs from non-SAP (sender idoc adapter) is not possibility to determine any port. Does exist a way how to force sender idoc adapter to use some specific IDX1 port?
Thank you in advance for every reply!
Regards,
Zbynek

The IDocs are sent from non-SAP system by means of tRFC. Connection type of the RFC destination is type T (TCP/IP) and activation type is Registered Server Program.
If we sent the IDoc directly into SAP ERP (where the IDoc Type is known) everything is fine
Edited by: Zbynek Kabrt on May 19, 2009 8:59 PM

Non SSL website on port 443

Hi, I have a non-SSL website running on port 443. When I access this website using Chrome or IE it works just fine, but Firefox can't seem to accept what I have done. All browsers on the same machine and using the same web proxy.
I access the website as http://xyz:443.
Just a bit of background info as to why I need this. Where I work I can only access ports 443 and 80 via the web proxy. I have two distinct websites running on a couple of devices at home behind a very config-wise limited router which has ports 80 and 443 redirected to these hosts. There is no way for me to setup two port forward rules on port 80 to two different devices. I cannot setup SSL on either of the websites.
Regardless of options that could exist to overcome my particular issue, I would like to check if you guys know how to make Firefox work with a website running on port 443 whilst not having a certificate assigned to it.
Firefox 32.0.3
Error message:
The connection was reset
The connection to the server was reset while the page was loading.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.

What type of ssl are you running? [https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/]
You can somehow remove the Strict-Transport-Security header or if there is a feature that forced encryption but by default https uses 443 for encryption. I do not know if this is possible.

Port 443 on UNIX not run as root? Can it be done?

This is probably more a UNIX question then a java question but I would like to know if it is possible to run a java server on port 443 in a non-privileged account sandbox. I don�t like the idea of running my server as root but would like use port 443 for my HTTPS server.
Can this be done? Any ideas?

Unix root privileges are required to bind to a port less than 1024, so your program must be setuid root or be started from the root account. However it can drop those priveleges immediately it has the port (i.e. the ServerSocket, by calling setuid() to another account and setgid() to another group. You need a bit of JNI to organize this from Java, sorry.

Port 443

Is it possible to run iSQL*Plus only using Port 443/SSL? I receive the following
error whenever I do not listen for port 80 connections:
[Mon Sep 16 13:29:58 2002] [emerg] OPM: Could not find a valid non-ssl LISTEN ip
and port. The whole process exits.
[Mon Sep 16 13:29:58 2002] [alert] (2)No such file or directory: FastCGI: read()
from pipe failed (0)
[Mon Sep 16 13:29:58 2002] [alert] (2)No such file or directory: FastCGI: the PM
is shutting down, Apache seems to have disappeared - bye

Alison,
Thanks for the reply. I think that the httpd.conf file is saying if you want both
types of connections (http and https) you have to listen for both types of connections.
We have other Apache web servers here that only allow https/port 443 connections and
only listen for those type of connections.
Maybe I should have asked my question a different way, is it possible configure
iSQL*Plus via the httpd.conf file (and other .conf files) so that FastCGI will
work with SSL connections? If not, is there a way to configure everything so that
the only non-SSL connections are between FastCGI and iSQL*Plus (i.e., no users can
connect to the web server without using and SSL connection)?
Again, thanks for your help.
Cecil,
After reading the httpd.conf (web server config file), I found this:
# Port: The port to which the standalone server listens. Certain firewall
# products must be configured before Apache can listen to a specific port.
# Other running httpd servers will also interfere with this port. Disable
# all firewall, security, and other services if you encounter problems.
# To help diagnose problems use the Windows NT command NETSTAT -a
Port 7778
## SSL Support
## When we also provide SSL we have to listen to the
## standard HTTP port (see above) and to the HTTPS port
Listen 7778
Listen 4443
It looks like you have to listen on a default port, as well as on an https port. iSQL*Plus doesn't actually care which port it is being called from as it is one step removed and has it's own (different) port connection to the web server.
Perhaps this is a question to research from the web server (essentially Apache) point of view? You could try the usenet newsgroups, the Metalink web site, or you could call Oracle Support.
Alison

HTTPS (port 443) for RVS4000 Router

Hello All
I have two servers - one running MS exchange and the other running a crm platform and both must be access via https. On the router -I have bound https to one ip address and router refuses to accept the binding of the same port 443 to another ip address. I will appreciate any help I can get towards resolving this.
The network diagram is attached.

Hello!
Unfortunately it is not possible to have same port forwarded simultaneously to several internal IP addresses - just imagine even if this setting would be possible, how the router will know which request to which internal server to forward since the port where request was received is the same?
However, with RVS4000 you can do the following - use TCP 443 for server1 and let's say TCP 4443 for server2.
Let's assume that your servers have the following IP address assignement:
Server1 - 192.168.8.100
Server2 - 192.168.8.101
In RVS4000 go to Firewall -> Single Port Forwarding
Configure it as on the screenshot:
After that you can access from the Internet both servers using the following URL:
Server1 - https://wan_ip_address
Server2 - https://wan_ip_address:4443
Hope it will solve your problem!
Best regards,
Ivan Bondar
Cisco Small Business Support

Syn flood signature 6009/0 actions

Hi is there an option when this signature fires to block the attacker or this attack and not just log the attack? I tried to set the actions but the log says no action taken.

Hi Thx for the answer. I did add the action but no luck or does it nog log this action? The traffic hits the client inside the network so the ips does not block.
Event ID
1397033001306299442
Severity
high
Host ID
IPS-DEB1-1
Application Name
sensorApp
Event Time
01/06/2015 10:18:30
Sensor Local Time
01/06/2015 09:18:30
Signature ID
6009
Signature Sub-ID
0
Signature Name
SYN Flood DOS
Signature Version
S593
Signature Details
SYN Flood DOS
Interface Group
vs1
VLAN ID
0
Interface
te7_0
Attacker IP
xx.xx.xxx.84
Protocol
tcp
Attacker Port
1321
Attacker Locality
OUT
Target IP
yy.yy.yy.102
Target Port
80
Target Locality
OUT
Target OS
unknown unknown (relevant)
Actions
Risk Rating
TVR=medium ARR=relevant
Risk Rating Value
95
Threat Rating
95
Reputation
Context Data
Packet Data
Event Summary
0
Initial Alert
Summary Type
Final Alert
Event Status
New
Event Notes

Port 443 and 80 are blocked in FolderShare

Hi,
I'm using FolderShare to sync my iMac with a WinXP laptop, but it only works one-way. The Mac dosn't accept any connections from the laptop.
In the settings for FolderShare i can see that port 443 and 80 are blocked. I have tried port forwarding these ports to my static ip, but it dosn't work on the mac. FolderShare support says that this a mac problem, so i guess i have to open these ports somehow. Can you help?
I don't have the OSX firewall enabled.

No, it really shouldn't be the router, if you're both on the same side. Except...it seems that this foldershare might be using a proxy to work its magic.
(check router for any firewall settings, and disable them during this testing.)
I was able to make this work on a mac>PC and PC>mac on the same side of the router, but the folderShare settings test also told me that ports were blocked. (it still worked)
You know...I would probably start file sharing, and possibly web sharing. I have both those enabled on my little mini-mac. Enable those in the sharing tab, leave the firewall alone for now.

2 Webdispatchers same host same port 443

Is it possible to 2 Webdispatcher instances on the same unix host both being able to respond to their own requests on the sap port either 80 or 443?
I am having trouble having 2 WDs workong on the same port, but normal netweaver aka ECC6 can both listen on the same port (8000) with the host= option set.
is it possible to have WD do this (noting the port in question is 443 or 80 so I had to set the EXTBIND option).
Thanks
Tony

Hi,
Did you installed webdispatchers on a single host with comman hostname or with virutal hostname.
2 different application on single host with same port number in following cases.
1. There should be 2 ip address mapped on single host ( This can be done by you system team )
2. Both the webdispatcher should be installed with 2 different virutal hostname
( every virtual hostname is bind on different ip )
Port depend upon ip address ., it mean port 443 can run on differently on both the ip address .
Any query .. pls reply
Thanks
Anil

Possible SYN flooding on port 443. Sending cookies.

Similar Messages

Maybe you are looking for