Firewall:Winnuke detected Firewall:SYN Flood detected

[freeek]

what does that mean? My router log shows two things happening a couple of times over the past few days
Examples:
11/04/2007 20:52:08> Firewall:SYN Flood detected,from 193.108.95.17 to 192.168.1.136
11/09/2007 01:55:22> Firewall:Winnuke detected,from 41.242.195.158 to 41.245.157.77

 

[RSkeens]

Hi freeek,

What you are seeing is a relatively outdated (but still the most popular form) form of DoS. Basically what is happening is a client attempts to make a connection to a server system (you), but the server does not receive a valid network address to make an ACKnowledgement reply. This causes the server to use up resources trying to reply. In my experience, the time used until the server gives up is a few minutes.

Most network operating systems and network equipment nowadays are resilient to these types of attacks and check the packet headers, source IP addresses, etc.

What counts most though is how often these occur (as in the frequency at a given peak time). You need a lot of bandwidth (as well as different IP addresses as not to alarm the firewall by connecting loads of times from the same address) to conduct an attack like this successfully and I doubt one machine alone could affect you in a large way (given you just ignore it).

 

[Praeses]

what does that mean? My router log shows two things happening a couple of times over the past few days
Examples:
11/04/2007 20:52:08> Firewall:SYN Flood detected,from 193.108.95.17 to 192.168.1.136
11/09/2007 01:55:22> Firewall:Winnuke detected,from 41.242.195.158 to 41.245.157.77

I also get those
The formatting looks a lot like my microcom router's formatting

 

[Impregim]

what does that mean? My router log shows two things happening a couple of times over the past few days
Examples:
11/04/2007 20:52:08> Firewall:SYN Flood detected,from 193.108.95.17 to 192.168.1.136
11/09/2007 01:55:22> Firewall:Winnuke detected,from 41.242.195.158 to 41.245.157.77

Ignore it.