For what its worth, we are looking at this. - paul At 04:32 PM 9/17/96 -0700, Leonid Egoshin wrote:

...

From: "Forrest W. Christian" <forrestc@iMach.com>

5 minute SYNS: 123423 5 minute SYN-ACKS: 50000

Then, if the ratio got too high, it can start yelping about "Potential SYN D-O-S Atttack in progress on Interface Serial 1"

I suggest to check not only ratio (assymetric routing !), but high number of SYNs to single host.

- Leonid Yegoshin, LY22

-- Paul Ferguson || || Consulting Engineering || || Reston, Virginia USA |||| |||| tel: +1.703.716.9538 ..:||||||:..:||||||:.. e-mail: pferguso@cisco.com c i s c o S y s t e m s