Possible SYN flooding on port 8200. Sending cookies.

[umrico]

Good Day,

I keep getting the following a couple times a minute and I can't figure out what it is for the life of me. How can I troubleshoot this? TIA for your help it is greatly appreciated!!!

Feb 13 18:58:17 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:17 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.
Feb 13 18:58:22 kernel: TCP: Possible SYN flooding on port 8200. Sending cookies.

 

[ColinTaylor]

Router model?
Firmware version?

Do you have the router's Media Server enabled? Have you disabled the router's firewall?

 

[umrico]

Router model?
Firmware version?

Do you have the router's Media Server enabled? Have you disabled the router's firewall?

Rt-ac-68u

FW 384.15. it's happened on at least the last 3 versions that I have noticed anyway.

Upnp media server was turned on. I don't recall flipping that on. That may have instantly solved the problem.A that's the problem, why would that be?

Firewall is on.

Thanks again for you help! Googled this forever and tried running a wireshark but couldn't see the problem!

 

[ColinTaylor]

A that's the problem, why would that be?

Firewall is on.

If the firewall in on then I can only assume that something on your LAN is spamming the media server. To discover what you'd have to run tcpdump on the router, or systematically turn each device on your LAN off until you find the culprit. I'd suspect devices like smart TV's or media servers (e.g. Roku, AppleTV, etc.).

 

[umrico]

If the firewall in on then I can only assume that something on your LAN is spamming the media server. To discover what you'd have to run tcpdump on the router, or systematically turn each device on your LAN off until you find the culprit. I'd suspect devices like smart TV's or media servers (e.g. Roku, AppleTV, etc.).

Thank you so much for your help i appreciate!

 

[gburlingame]

@umrico I was wondering if you tracked down the source of your issue. I am also seeing this message in my system log. Thanks!

 

[umrico]

@umrico I was wondering if you tracked down the source of your issue. I am also seeing this message in my system log. Thanks!

To be completely honest not terribly sure. I remember I had to shut off the media server/upnp/itunes server at one point to resolve an issue but don't recall if it was specifically for this... Give it a shot if you have them on and don't use them maybe?

 

[gburlingame]

Thanks @umrico . I did turn them off, but the problem persists.

The port number in my message is different and has changed a few times so I may have a different culprit. Right now it is port 41674.

I need to figure out how to determine the IP address of the device that is causing this issue. I don't know if I am being attacked (doubtful but possible) or if a device on my LAN is behaving badly.