[squid-users] possible SYN flooding on port 3128

Hello.

I noticed my internet connection was crawling, not even google.com would open. I checked syslog and noticed:

kernel: possible SYN flooding on port 3128. Sending cookies.

I also checked netstat -nat and noticed a lot about 1200 of ESTABLISHED connections from one ip address.

I called this person and told me no one was using that machine.

I have Squid Cache version 3.1.0.14 for i686-pc-linux-gnu and have Enable TCP SYN Cookie Protection

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

Is this a virus? Any suggestions?

      
Received on Wed Nov 25 2009 - 13:51:23 MST