Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server ( recently had an outrage. One of the suspecious things I found was loads of SYN flooding messages in /var/log/messages

Feb  8 15:17:34 app kernel: possible SYN flooding on port 80. Sending cookies.
Feb  8 15:36:58 app -- MARK --

There are loads of SYN flooding errors and loads of -- MARK -- entries. What does this mean. Any correlation of data in munin graphs and this SYN flooding error that I should be aware / cautious about.

How can I fix this and what could be the possible error


share|improve this question
up vote 0 down vote accepted

The --MARK-- entries are harmless, they are a result of the syslog mark feature being enabled, and just provide regular timestamps in the logfiles so that, if things are quiet, you can be sure that syslog is still writing.

I'm afraid I can't comment on the syn flooding entries, which are indeed interesting. Hopefully someone else can shed light on those.

Sparsh, if I might comment, you've now asked eight questions on serverfault, and accepted no answers. The local etiquette is that when you're happy with an answer, you accept it, by clicking on the tick outline (if memory serves); that drives the reputation system. Of course, you might really not be happy with any of the answers offered to any of your questions, and if that's so then I apologise. But we see a red "0% accept rate" warning by your username, and that often deters people from answering your questions. You might want to spend a little time going back through your previous questions, and accepting the most satisfactory answer for each one.

share|improve this answer
Thanks for letting me know about the accepting system. I was completely unaware of it. I will review all my questions and answers now – Sparsh Gupta Feb 8 '11 at 17:32
Sparsh: thank you for taking the pointer so graciously, and I'm glad to help. Sorry not to have a knowledgable answer about SYN cookies. – MadHatter Feb 8 '11 at 17:49
Part of the troubleshooting process in this case would be to set up a packet capture on the host in question and verify whether or not there is SYN flooding going on. – joeqwerty Feb 8 '11 at 22:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.