(1) this does not necessarily mean you are getting syn flooded.
Note the word "possible". All that you can really say is that
you had more incoming requests for connects than you could
deal with. It may only mean that you should increase your listen
backlog on some service. If you are really under attack you
should be seeing lots of these messages. The 2.1.31 code should
at least report the port number so you know what service needs
to have its backlog increased.
(2) If you are really under attack, then by the very nature of the
SYN flood attack it is not possible to know from whom the attack
is coming. The kernel only knows the spoofed address on the the
SYN packets that are arriving, and those are anything but the
address of the attacker.
-- Eric Schenk www: http://www.dna.lth.se/~erics Dept. of Comp. Sci., Lund University email: Eric.Schenk@dna.lth.se Box 118, S-221 00 LUND, Sweden fax: +46-46 13 10 21 ph: +46-46 222 96 38