what does "possible SYN flooding on port 8009. Sending cookies" mean in /var/log/messages?

apache tomcat redhat mod-jk flooding
taras picture taras · Nov 13, 2010 · Viewed 8.9k times · Source

I have a web application setup apache+mod_jk+tomcat(connector for mod_jk on 8009 port). Recently my app started to hang few times a day and in /var/logs/messages there are entries like "possible SYN flooding on port 8009. Sending cookies" with 30-60 seconds. I have to restart each time when the app hangs.

Is it DDOS attack ? or system/application errors can cause this problem ?

Any help would be highly appreciated.

Thanks.

Answer

Konerak picture Konerak · Nov 13, 2010

This article about tcp_syncookies might help explain the problem.

Someone or something is sending SYN packets to your application. It might be a legit client that does not receive the ACK cookie (is your application working?), or it might be someone malevolent (is it distributed or not).

Related questions

Difference between the Apache HTTP Server and Apache Tomcat?

What is the difference in terms of functionality between the Apache HTTP Server and Apache Tomcat? I know that Tomcat is written in Java and the HTTP Server is in C, but other than that I do not really know …

Read More
How to Detect cause of 503 Service Temporarily Unavailable error and handle it?

i am getting the error 503 Service Temporarily Unavailable many times in my application and i want to detect why this error occurs, how ? if there's a log file or something like that, since i am not familiar with apache. second …

Read More
Error during SSL Handshake with remote server

I have Apache2 (listening on 443) and a web app running on Tomcat7 (listening on 8443) on Ubuntu. I set apache2 as reverse proxy so that I access the web app through port 443 instead of 8443. Besides, I need to have SSL communication …

Read More