Re: tcp messages I've never seen now in Current and atheros interrupt storm

From: Steve Kargl <sgk_at_troutmask.apl.washington.edu>
Date: Thu, 26 Jul 2007 12:24:34 -0700
On Thu, Jul 26, 2007 at 03:22:05PM -0300, Nenhum_de_Nos wrote:
(snip)
> Jul 26 12:20:10 lamneth kernel: TCP: [60.29.8.98]:32191 to
> [192.168.254.10]:10010 tcpflags 0x11<FIN,ACK>; syncache_expand:
> Segment failed SYNCOOKIE authentication, segment rejected (probably
> spoofed)

(snip)

> the message on google just returned the .c code file, so, if anyone
> has a clue ...

These messages are well known to anyone running a recent -current.
Someone once stated that the messages are mostly benign diagnostics.
Why the message isn't hidden behind bootverbose, a sysctl tunable,
or rate limited it is a mystery.

troutmask:kargl[225] grep RST messages | wc -l
     483
troutmask:kargl[226] foreach i (messages*bz2)
foreach? zcat $i | grep RST| wc -l
foreach? end
     553
     588
     525
     357
     449

-- 
Steve
Received on Thu Jul 26 2007 - 17:25:38 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:39:15 UTC