Klaus Alexander Seistrup wrote: > Jorijn Schrijvershof wrote: > > >> Earlyer this evening there were 5000 (!) connections. My firewall >> configuration classified this as an utp flood and dropped a lot of requests. >> >> I would like to know if this high loads of traffic are normal. If so I have >> to adapt the configuration. >> > > It could be traffic from Türk Telekom, please read the recent thread: > http://fortytwo.ch/mailman/pipermail/timekeepers/2007/003225.html > > Cheers, > Thanks for the information, I didn't have the time to read the whole thread but managed to do the first 20 ones. As I understanded Türk Telekom only has servers from Europa in its routers, whilst ntp.jorijn.com is located in the northern of America. Currently the firewall is still in its default settings which is a limit of 10 new UDP connections per second. This with a burst rate of 60.
As normally I will monitor the system for any strange activity again. If so I'll compare the hosts and check from which subnet they are. If find out they are all unique, or totally random it would be a matter of changing the security of my server. Kind regards, Jorijn. _______________________________________________ timekeepers mailing list [email protected] https://fortytwo.ch/mailman/cgi-bin/listinfo/timekeepers
