flood attacks

From: Ronan Lucio (ronan@melim.com.br)
Date: 09/27/01 

From: "Ronan Lucio" <ronan@melim.com.br>
To: <freebsd-security@freebsd.org>
Date: Thu, 27 Sep 2001 10:26:06 -0300

Hi All,

Some times Iīm having troubles with somebody attacking
my network by RST flood

I have two questions:

1. My FreeBSD-4.3 only show the message
    Limiting closed port RST response from 1800 to 200 packets per second.
    But, it donīt show the source IP of attack. I already looked at
    /var/log/messages, security and ipfw files and I saw nothing about this.
    Does anybody knows what option should I configure to FreeBSD show
    me such IP?

2. My computers are FreeBSD-4.3 and my router (Cisco) already has the
    option "no-ip-broadcast" seted.
    What more do I need to do to prevent such type of attacks?
    OBS: Monitorate it on saturday 4:00 a.m. is difficult. I need find out
              some way to automatize it.

Thankīs to all,

Ronan Lucio

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message