nanog mailing list archives
Gratuitous syn/ack
From: Pete Carah <pete () altadena net>
Date: Thu, 11 Nov 2010 17:31:04 -0500
I'm seeing a significant number (about 1/minute 24 hr/day) of syn/ack packets coming from port 80 of random addresses to random ports on my nameserver and a few other systems. This isn't enough traffic to be really annoying, but is curious. I wonder if the simple explanation (backscatter from syn floods with spoofed source addresses) is more likely, or if there are some probing techniques in "normal" use that use these packets (one could accomplish a traceroute using port 80 packets in either direction...) -- Pete
Current thread:
- Gratuitous syn/ack Pete Carah (Nov 11)
- Re: Gratuitous syn/ack Joel Esler (Nov 11)
- Re: Gratuitous syn/ack Randy (Nov 11)
- Re: Gratuitous syn/ack Joel Esler (Nov 11)