RV320 massive SYN Flooding attacks?

Hi
I have purchased a RV320 small business router for my home office, but i am experiencing massive SYN Flooding attacks when clients connect to my ftp and when rsync backup is performed.
My equipment consists of
Cisco RV320 Router running v1.1.0.09 (2013-07-04, 13:28:17) FW
Synology DS212 Nas
Setup
Cisco RV320 Router with static IP 192.168.1.1
WAN1 is used and configured with an static WAN IP
DHCP Range from 192.168.1.100 to 149
Port Range Forwarding Table
FTP[TCP/21~21] to IP 192.168.1.2
FTP Range[TCP/55536~55543] to IP 192.168.1.2
Rsync UDP[UDP/873~873] to IP 192.168.1.2
Synology DS212 Nas with static IP 192.168.1.2
Each time a user connects to my ftp server, I get a lot of these errors.
This is just a small sample of the log
[HACK] SynFlooding Attack
IN=eth1 OUT=eth0 SRC=xx.xxx.xx.xxx DST=192.168.1.2 DMAC=e0:2f:6d:75:34:d9 SMAC=00:13:72:52:16:5c LEN=52 TOS=0x00 PREC=0x00 TTL=120 ID=16112 DF PROTO=TCP SPT=45496 DPT=21 WINDOW=8192 RES=0x00 SYN URGP=0
The same happens when an rsync backup is running on my DS212
2013-10-05, 12:11:15
[HACK] SynFlooding Attack
IN=eth1 OUT=eth0 SRC=xx.xxx.xxx.xx DST=192.168.1.2 DMAC=e0:2f:6d:75:34:d9 SMAC=00:13:72:52:16:5c LEN=60 TOS=0x00 PREC=0x00 TTL=54 ID=42649 DF PROTO=TCP SPT=36846 DPT=873 WINDOW=5840 RES=0x00 SYN URGP=0
If more information is needed please let me know
Any ideas why this happens?
Thanks
Martin

Maybe a stupid question, how do I create a support ticket?
If I click on the link "contact us" then I chose
Open a Technical Support Request here
But it require the following as you can read
Your login ID is not set up to access the TAC Service Request Tool (TSRT).
To obtain access, add all of your Cisco service contract numbers to your profile by going to the
Cisco Profile Manager - Request to Insert Contracts
. If you are a Cisco Partner or a customer with a Service Access Management Administrator, please contact that resource to obtain access to your service contracts. You may use the
Service Access Management Tool
to find your Service Access Management Administrator.
Unsure of your contract number? Your
Cisco Partner
, Reseller or Cisco Services representative can help provide a complete list of your service contracts.
The TAC Service Request Tool (TSRT) is designed to support contract-entitled services only at this time. For urgent issues or warranty service please contact the
Cisco Technical Assistance Center
via telephone.
See
Cisco Global Technical Services Quick Start Guide for additional assistance. Your login ID is not set up to access the TAC Service Request Tool (TSRT).
To obtain access, add all of your Cisco service contract numbers to your profile by going to the Cisco Profile Manager - Request to Insert Contracts. If you are a Cisco Partner or a customer with a Service Access Management Administrator, please contact that resource to obtain access to your service contracts. You may use the Service Access Management Tool to find your Service Access Management Administrator.
Unsure of your contract number? Your Cisco Partner, Reseller or Cisco Services representative can help provide a complete list of your service contracts.
The TAC Service Request Tool (TSRT) is designed to support contract-entitled services only at this time. For urgent issues or warranty service please contact the Cisco Technical Assistance Center via telephone.
See Cisco Global Technical Services Quick Start Guide for additional assistance.

Similar Messages

SYN flood attack log In CSA MC

I got an SYN flood attack log in CSA MC
CSA log: TESTMODE: A potential SYN Flood attack has been detected. This may also indicate a possible routing problem. Reason: The TCP Listen Queue is full using interface Wired\HP NC7781 Gigabit Server Adapter #2. TCP: CSA MC IP/5401->local Instance IP/4418, flags 0x12. The operation would have been denied.
(Note: In log I have specified CSA MC IP and local Instance IP instead of its IP address)
I understood that SYN flooding is a type of denial of service attack and this alert has occured when a TCP/IP connection was requested by MC to the Instance. It has resulted in a half open connection, as the return address that is not in use. MC has detected it and it got denied.
Please let me know what action I have to take at tins point?
Thanks
Arumugam.K

Arumugam,
We've been having similar issue regarding SYN flood alerts. The affected system in turn starts to send additional ACK requests. This results in issues with the IIS functionality on that server. Clients begin to no longer have the ability to access the site hosted on the server. We've been battling between Cisco and Microsoft on this one. The issue appears to have started around Patch Tuesday in February.
My question to you is this: Have you noticed any latency with the system that is reporting the SYN flood? I'm curious if the problem is local to us, or possibly wide spread.

A SYN flood attack!

when i run
server$ dmesg command i got this message.
WARNING: High TCP connect timeout rate! System (port 8080) may be under a SYN flood attack!

is the ip given a public ip and is the sun machine behind a firewall or running a firewall? most new deployed servers will not see enough traffic on segments behind firewalls to cause messages like this. ive run scanners that can cause messages like this or test clients that generate load as well...

Syn flood attack?

Hello,
I work in an organization in which there is an automatic monitoring of network connections. Yesterday I had a notification of a possible syn flood attack originated by my Mac targeting an IP address (and port: 8000) that I found out to be associated to an internet radio. I did some network monitoring and I found out that with iTunes closed there were no packets with that IP as destination address... has anyone experinced such a problem?
Sincerely
Giuseppe

Arumugam,
We've been having similar issue regarding SYN flood alerts. The affected system in turn starts to send additional ACK requests. This results in issues with the IIS functionality on that server. Clients begin to no longer have the ability to access the site hosted on the server. We've been battling between Cisco and Microsoft on this one. The issue appears to have started around Patch Tuesday in February.
My question to you is this: Have you noticed any latency with the system that is reporting the SYN flood? I'm curious if the problem is local to us, or possibly wide spread.

Syn flood signature 6009/0 actions

Hi is there an option when this signature fires to block the attacker or this attack and not just log the attack? I tried to set the actions but the log says no action taken.

Hi Thx for the answer. I did add the action but no luck or does it nog log this action? The traffic hits the client inside the network so the ips does not block.
Event ID
1397033001306299442
Severity
high
Host ID
IPS-DEB1-1
Application Name
sensorApp
Event Time
01/06/2015 10:18:30
Sensor Local Time
01/06/2015 09:18:30
Signature ID
6009
Signature Sub-ID
0
Signature Name
SYN Flood DOS
Signature Version
S593
Signature Details
SYN Flood DOS
Interface Group
vs1
VLAN ID
0
Interface
te7_0
Attacker IP
xx.xx.xxx.84
Protocol
tcp
Attacker Port
1321
Attacker Locality
OUT
Target IP
yy.yy.yy.102
Target Port
80
Target Locality
OUT
Target OS
unknown unknown (relevant)
Actions
Risk Rating
TVR=medium ARR=relevant
Risk Rating Value
95
Threat Rating
95
Reputation
Context Data
Packet Data
Event Summary
0
Initial Alert
Summary Type
Final Alert
Event Status
New
Event Notes

Sig SYN Flood DOS id="6009" dest address 0.0.0.0

Hi, All!
I receive sig 6009 with destination address 0.0.0.0:
evIdsAlert: eventId="1244180117471597849" severity="medium" vendor="Cisco"
originator:
hostId: IDS
appName: sensorApp
appInstanceId: 413
time: Jul 6 2009 14:18:14 EEST (1246879094502611000) offset="180" timeZone="UTC"
signature: created="20060220" type="anomaly" version="S214" description="SYN Flood DOS" id="6009"
subsigId: 0
sigDetails: SYN Flood DOS
marsCategory: DoS/Host
marsCategory: DoS/Network/TCP
interfaceGroup: vs0
vlan: 0
participants:
attacker:
addr: 192.168.155.72 locality="OUT"
port: 0
target:
addr: 0.0.0.0 locality="OUT"
port: 0
os: idSource="unknown" relevance="unknown" type="unknown"
summary: 3 final="true" initialAlert="1244180117471597835" summaryType="Regular"
alertDetails: Regular Summary: 3 events this interval ;
riskRatingValue: 63 targetValueRating="medium"
threatRatingValue: 63
interface: fe0_1
protocol: tcp
I cannot get at the meaning - address 0.0.0.0?
It`s bug?

No, it's not a bug. The scanning signatures summerize the attacked addresses into 0.0.0.0
This is because in scans there are a LOT of dezstination addresses that are hit inorder to fire the signature but there is only one attacked address field in ever signature.

Syn Flood :0(

We have a very large network at work and we have been having some internet timeout issues so we got some people in to monitor packets and perform a general network health check.
I got called up by the networking people saying that there has been a syn flood detected coming from my mac address on my macbook :0(
I know that mac’s are subject to network attacks but I thought that I have covered all my bases, I have Symantec installed and I keep up to date with my security updates etc.
Can anybody give me any pointers as to where to start to diagnose if there is an issue with my mac, I have used macscan and that found nothing I have also used little snitch to see if anything crops up asking for a network connect but nothing :0(
Any suggestions are greatly appreciated!

Sounds like something that should be posted to the Networking or Server Products forum.

Syn flood software?

i'm trying to test some syn flood mitigation techniques in my lab studies and i'm looking for a decent syn flood prog if anyone knows of one. tia.

If you check out the Sectools website (sectools.org) or if you download BackTrack (http://www.remote-exploit.org/backtrack_download.html) you can find a lot of really useful tools. Most of these are hacking tools so be sure to use them in accordance with whatever policies you are subject. I've used hPing in the past to simiulate syn floods and dDos attacks.
Good luck!

Syn flood DOS (6009)

The signature for syn flood DOS (6009) has two values that I can see will alter the signature threshold.
event-counter
event-count: 2600 default: 200
event-count-key: AxBx <defaulted>
specify-alert-interval
yes
alert-interval: 2 default: 2
The definition for the signature is that it will detect a flood of TCP SYN packets at a rate of 100 per second or greater. We have tried to adjust the signature that this value is higher and no matter what the event count is, it continues to trigger in our environment. At 1300 syns per/sec, (event-count: 2600) an alert is still received for http proxy servers.
Have I over looked the parameter that needs to be adjusted in order to increase the threshold of this signature or is it just not tunable.

By default, flows with 200pkts/2sec above are alerted. You can change the threshold by CLI

Possible SYN flooding on port 443. Sending cookies.

I have an older mobility server. 221 users. Version 1.2.4 build 966. Its on SLES 11 sp1. Also a bit dated. Early in the morning Saturday the server...

I have a working GroupWise Mobility service, but recently had to change
the SSL certificate, because the validity of the previous expired....

Possible SYN Attack

I am getting an alert from 2 of my servers. The alert is worded as such: [ID 995438 kern.warning] WARNING: High TCP connect timeout rate! System (port 25) may be under a SYN flood attack!
My system is Version 5.9 patch level Sun Generic_122300-38
I have found other postings with this very issue, but they're pertaining to version 5.10. They refer to patch 11999-03, which is now obsolete, however, this patch will not work for my system.
Can someone help point me in the right direction to the patch that will work for my system?

Solaris by default is not tuned particularly well for handling large numbers of tcp connections.
So if the servers are busy, that could easily trigger these messages.
Try putting the following into a startup script to adjust the tuning.
I have found it helpfull on our high activity web/proxy servers.
/usr/sbin/ndd -set /dev/tcp tcp_conn_req_max_q0 8192
/usr/sbin/ndd -set /dev/tcp tcp_conn_req_max_q 2048

ASA-5520 Monitoring Attacks

Hello ASA experts,
If you caught a syn flooding attacks against your ASA, what is the best approach to mitigate/prevent that from occuring? Also, what is the best method to monitor such attacks?
Best, ~sK

Thanks for the response! That's exactaly what we did; however, we enabled the scanning thread detection and implemented a threat-detection policy to shun any suspecious attacker.
We use Whatsup Gold and do have all of our ASAs monitored but don't have an snmp for the connection count. Can you please share the snmp active monitor used to monitor the connection count?
Much appreciated..
Best, ~sK
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bd3913.shtml
Scanning Threat Detection
Scanning Threat Detection is used in order to keep track of suspected attackers who create connections too many hosts in a subnet, or many ports on a host/subnet. Scanning Threat Detection is disabled by default.
Scanning Threat Detection builds on the concept of Basic Threat Detection, which already defines a threat category for a scanning attack. Therefore, the rate-interval, average rate (ARI), and burst rate (BRI) settings are shared between Basic and Scanning Threat Detection. The difference between the 2 features is that while Basic Threat Detection only indicates that the average or burst rate thresholds were crossed, Scanning Threat Detection maintains a database of attacker and target IP addresses that can help provide more context around the hosts involved in the scan. Additionally, only traffic that is actually received by the target host/subnet is considered by Scanning Threat Detection. Basic Threat Detection can still trigger a Scanning threat even if the traffic is dropped by an ACL.
Scanning Threat Detection can optionally react to an attack by shunning the attacker IP. This makes Scanning Threat Detection the only subset of the Threat Detection feature that can actively affect connections through the ASA.
When Scanning Threat Detection detects an attack, %ASA-4-733101 is logged for the attacker and/or target IPs. If the feature is configured to shun the attacker, %ASA-4-733102 is logged when Scanning Threat Detection generates a shun. %ASA-4-733103 is logged when the shun is removed. The show threat-detection scanning-threat command can be used in order to view the entire Scanning Threat database.

SG300-10P SYN Protection

Hi Community,
just registered after reading some topics in the last months. Great answers here - thank you for that!
No I have a minor issue with a new feature and did not find any solutions yet.
Yesterday I upgraded my SG300-10P to firmware 1.2.7.76. I was curious about the new SYN Protection feature, but it seems to do nothing on my installation.
The switch is running in Layer 2 mode. I have ACLs in place and DoS prevention is not enabled. I also tried clearing ACLs and enabling DoS prevention. As I understood the Admin Guide enabling DoS in the Security Suite Settings is not necessary for using the SYN Protection.
In my firewall I see about 300 pps with SYN flags only arriving. What "they" do is sending me SYN packest to port 80 from forged IPs, so that my system should send SYN-ACKs to the victim system. In this case it is the Arab Bank. They are down at the moment...I think that is called a spoofed SYN flood attack.
So I thougt the SYN Protection feature should exactly solve that problem but it does not and does not show any "Last Attack" entries.
If I put a SYN filter in place it works, even if I put SYN Rate Protection in place. But that is just a dirty workaround.
Did I miss something?
Maybe somebody has some hints for me!
Best wishes,
Alex
BTW: my firewall blocks those SYN packets with a SNORT rule, so I am no "helper" to those attacks and that is why the problem is minor to me.

Well, finally I discovered that I can provocate an attack with hping3 but only when I flood the switch interface address itself not other hosts on other switch ports. I can bring them down without any reaction from the switch.
So it seems, that the feature SYN Protection only protects the switch itself from SYN floods.
Not as useful as I thought.
Best wishes,
Alex

Dhcpcd giving 169 IP address

I just got back to school. At home I was using my desktops wired connection just fine. When I got back to school I booted up my machine and tried to do a dhcpcd eth0 but the broadcasting for a lease times out and then I end up with a 169 IP. I've tried downgrading dhcpcd didn't work. I've tried a different NIC and I would get an IP but no DNS. I've tried different cable on the NIC that would get 169. I've tried plugging that NIC into a different port. I plugged my laptop into the port and that would get an IP just fine. My school does use some cisco NAC agent for authentication but the desktops MAC address is, or at least should be, on there whitelist. I've been fussing with this for like four days and the school IT people aren't very helpful. Heres the output from ip addr eth0 is the one getting a 169 and eth1 is the new NIC I put in to test...
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 54:04:a6:20:29:97 brd ff:ff:ff:ff:ff:ff
inet6 fe80::5604:a6ff:fe20:2997/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0a:cd:1f:01:a9 brd ff:ff:ff:ff:ff:ff
inet 150.156.223.152/20 brd 150.156.223.255 scope global eth1
inet6 fe80::20a:cdff:fe1f:1a9/64 scope link
valid_lft forever preferred_lft forever
output of lspci the Intel is the on board NIC I normally use thats getting the 169, the realtek is one I borrowed to test.
02:00.0 Ethernet controller: Intel Corporation 82583V Gigabit Network Connection
Subsystem: ASUSTeK Computer Inc. Device 8457
Flags: bus master, fast devsel, latency 0, IRQ 97
Memory at fe900000 (32-bit, non-prefetchable) [size=128K]
I/O ports at d000 [size=32]
Memory at fe920000 (32-bit, non-prefetchable) [size=16K]
Capabilities: [c8] Power Management version 2
Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
Capabilities: [e0] Express Endpoint, MSI 00
Capabilities: [a0] MSI-X: Enable- Count=1 Masked-
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Device Serial Number 54-04-a6-ff-ff-20-29-97
Kernel driver in use: e1000e
06:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168B PCI Express Gigabit Ethernet controller (rev 03)
Subsystem: Realtek Semiconductor Co., Ltd. TEG-ECTX Gigabit PCI-E Adapter [Trendnet]
Flags: bus master, fast devsel, latency 0, IRQ 98
I/O ports at c000 [size=256]
Memory at fe500000 (64-bit, non-prefetchable) [size=4K]
Memory at d0000000 (64-bit, prefetchable) [size=16K]
Expansion ROM at d0020000 [disabled] [size=128K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
Capabilities: [70] Express Endpoint, MSI 01
Capabilities: [ac] MSI-X: Enable- Count=4 Masked-
Capabilities: [cc] Vital Product Data
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Virtual Channel
Capabilities: [160] Device Serial Number 81-07-00-00-68-4c-e0-00
Kernel driver in use: r8169
I've even gone through and gotten ride of the /etc/dhcpcd.conf and seeing if that would work but it didn't. The problem could be on the schools side but my troubleshooting results tell me it could be either or. Does anybody have any ideas? I'm stumped
Thanks for all the help

My dhcpcd.conf file is...
nohook resolv.conf
noipv6rs
My resolv.conf is...
nameserver 150.156.208.2
My sysctl.conf is...
# Configuration file for runtime kernel parameters.
# See sysctl.conf(5) for more information.
# Have the CD-ROM close when you use it, and open when you are done.
#dev.cdrom.autoclose = 1
#dev.cdrom.autoeject = 1
# Protection from the SYN flood attack.
net.ipv4.tcp_syncookies = 1
# See evil packets in your logs.
#net.ipv4.conf.all.log_martians = 1
# Never accept redirects or source routes (these are only useful for routers).
#net.ipv4.conf.all.accept_redirects = 0
#net.ipv4.conf.all.accept_source_route = 0
#net.ipv6.conf.all.accept_redirects = 0
#net.ipv6.conf.all.accept_source_route = 0
# Disable packet forwarding.
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0
#Disable IPv6
net.ipv6.conf.all.disable = 1
# Tweak the port range used for outgoing connections.
#net.ipv4.ip_local_port_range = 32768 61000
# Tweak those values to alter disk syncing and swap behavior.
#vm.vfs_cache_pressure = 100
#vm.laptop_mode = 0
#vm.swappiness = 60
# Tweak how the flow of kernel messages is throttled.
#kernel.printk_ratelimit_burst = 10
#kernel.printk_ratelimit = 5
# Reboot 600 seconds after kernel panic or oops.
#kernel.panic_on_oops = 1
#kernel.panic = 600
# Disable SysRq key to avoid console security issues.
kernel.sysrq = 0
And when I had Windows working it wasn't getting a good IP either, just a 169. I tried the windows trouble shooter or whatever and it kept telling me to check the router or something.

Firefox does not re-initiate TCP session when receiving RST-ACK

Hello guys,
I’m writing to report a disparity between firefox and IE/Chrome when receiving RST-ACK.
To mitigate SYN flood attack, one of the countermeasures of anti-ddos appliance is to reset the first 3-way handshake and expect a re-initiated new tcp session from that client. If the real client, browser for example, automatically re-initiate a new session, users won’t feel too much differences except time of delay. If a browser does not automatically start a new session, users have to manually refresh the page within an interval, like 60 seconds.
We got reports from customers that firefox gave notifications of connection reset, as Graph 1 is. I tested with IE11, Chrome and firefox. It’s found that Chrome and IE will automatically started a new session, while firefox does not. For firefox users, they had to manually refresh the page.
Anti-ddos appliance (A10 TPS, Arbor & HUAWEI secospace) does provide another option to avoid seeing this notification. I understand there must be consideration and good reasons for firefox to design the browser this way. May I ask whether it is possible to adjust a little on firefox to let it automatically re-fresh the page when seeing a RST-ACK please? Guess it’s quite common for firefox users to see the notification when access URLs during DDos attacks, because for A10 TPS & Arbor, the default setting is to reset the first 3-way handshake.
Feel free to let me know if I missed something and got things wrong.
Appreciate it much for your time!
Graph 1 Notification seen on screen
Graph 2 Screen shot of the captured packets
Graph 3 How it works for Arbor TMS to authentication a client by default.

ops, seems packets are not allowed to be uploaded. anyone willing to check my question, kindly reach me at [email protected]
Best regards,

RV320 massive SYN Flooding attacks?

Similar Messages

Maybe you are looking for