Phantom SYN_SENT, 386.7_2


Regular Contributor
I have two networks:: There are several Cisco switches in this network.

Networks are bidirectionally connected via OpenVPN on an Asus RT-AX68U fw. 386.7_2 router. There is a server (Smart Home) on the network Another network has a disabled media-player

I see a lot of messages in the logs of the Cisco switch:
A TCP SYN Attack was identified on port gi10.  TCP SYN traffic destined to the local system is automatically blocked for 60 seconds
in relation to the ports of the Asus router.
Analyzing the logs
router# netstat-nat | grep 'SYN_SENT'
I see 12 (+-1) permanent TCP SYN_SENT connections from to".

At the same time, there are no such requests from server to the host:
server$ netstat -na | grep ''

Question: where does the constant TCP SYN_SENT come from on the Asus router?

I am not suggesting that these two problems are related. Perhaps this is a coincidence.


Part of the Furniture
The TCP SYN_SENT entries from netstat-nat will hang around for a while even after the source machine has given up and closed its socket. If you constantly refresh the netstat command on the source machine you should be able to catch them.

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!