Router forwarding syn flood

Question

I have a C3700-100NAS without port forwarding and without the firewall disabled. On a machine inside the LAN I see:&nbsp;[~]pds$ netstat -aActive Internet connections (including servers)Proto Recv-Q Send-Q&nbsp; Local Address&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Foreign Address&nbsp; &nbsp; &nbsp; &nbsp; (state) &nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62209&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.128.204.http &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62208&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.64.175.http&nbsp; &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62207&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.64.249.http&nbsp; &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62206&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.64.249.http&nbsp; &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62205&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.64.175.http&nbsp; &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62204&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.64.175.http&nbsp; &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62203&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.128.204.http &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62202&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 151.101.128.204.http &nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62201&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ec2-54-247-187-9.http&nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ec2-54-219-132-1.http&nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62199&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ec2-54-219-132-1.http&nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62198&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ec2-54-219-132-1.http&nbsp; SYN_SENT&nbsp; &nbsp;tcp4 &nbsp; &nbsp; &nbsp; 0&nbsp; &nbsp; &nbsp; 0&nbsp; tango.62197&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ec2-54-215-180-1.http&nbsp; SYN_SENT&nbsp; &nbsp;&nbsp;etc...which is the residue from a syn flood attack. But why should the SYNs have been sent to this machine in the first place? I do assume they were sent to the broadcast address, but surely the router shouldn't propogate broadcasts to the LAN? Is this a bug or have I configured something wrong?&nbsp;Right now my network is unusable whenever this attack occurs.

phil-smith · Answer

Oops these aren't broadcast, they're directed to specific machines. Why is the router forwarding these packets?

TheEther · Answer

SYN_SENT means that your computer initiated a connection.  It is not a response to any SYN flood.

Forum Discussion

Router forwarding syn flood

2 Replies