Panix Administrators
What did they notice?
- Servers were unresponsive and approximately 6000 ISP customers had sporadic or non-existent connectivity
- Check servers state
- Resource Usage Up
- netstat showed connections in SYN_RCVD state
- netstat -a -f inet
- netstat -s | grep “listen_queue overflows”
- Received help from Cheswick
What did they do?
- Reduce IP Spoofing
- Increase listen queue and reduce time to wait for SYN