For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

smp_86112's avatar
smp_86112
Icon for Cirrostratus rankCirrostratus
Jan 22, 2009

Methodolgy to ID source of DOS attack

Recently, I started receiving SNMP traps from an LTM pair indicating it was the target of a possible DOS attack.     Limiting open port RST response from 16170 to 250 packets/sec   ...
management
monitoring
hoolio's avatar
hoolio
Icon for Cirrostratus rankCirrostratus
Jan 28, 2009
Do the embryonic connections show up in netstat -a output? Or do they have forged source IP addresses? I'm curious to see what options there are for tracing SYN floods.

 

 

Aaron