帮我看一下我的路由器是不是被攻击了？刷的TB梅林

yizhilikai

Feb  2 09:58:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:58:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:58:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 09:59:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:00:00 crond[692]: USER admin pid 10736 cmd /koolshare/scripts/ddnsto_check.sh
Feb  2 10:00:02 kernel: net_ratelimit: 6 callbacks suppressed
Feb  2 10:01:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:01:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:01:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:01:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:01 kernel: net_ratelimit: 2 callbacks suppressed
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:02:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:03:01 kernel: net_ratelimit: 7 callbacks suppressed
Feb  2 10:03:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:05:00 crond[692]: USER admin pid 12941 cmd /koolshare/scripts/ddnsto_check.sh
Feb  2 10:06:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:06:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:06:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:06:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:06:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:02 kernel: net_ratelimit: 1 callbacks suppressed
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:07:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:58 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:59 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:59 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.
Feb  2 10:09:59 kernel: TCP: Possible SYN flooding on port 34797. Sending cookies.

yizhilikai

一直是34797这个端口

juyyao

可能是 内部某个设备发起的

小白贰码叁

关掉网络设备查找一下那个设备在偷

yizhilikai

juyyao 发表于 2020-2-2 13:31
可能是 内部某个设备发起的

会不会是DDNS解析的原因？

yizhilikai

小白贰码叁 发表于 2020-2-2 14:02
关掉网络设备查找一下那个设备在偷

会不会是DDNS解析的原因？

houyu

不懂。帮顶

秦时老猫

打开syn cookies 调整下参数 再试试
sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.core.somaxconn=65535
sysctl -w net.core.netdev_max_backlog=65536
sysctl -w net.ipv4.tcp_max_syn_backlog=655350
sysctl -w net.ipv4.tcp_max_tw_buckets=655350