• SEARCH
  • DOWNLOADS
  • MY ACCOUNT
  • Buy (0)
  • CONTACT
  • Free Trial
Wowza Logo
  • PRODUCTS
  • DEVELOPER
  • SOLUTIONS
  • PRICING
  • RESOURCES
  • SUPPORT
  • My Account
  • Buy (0)
  • SEARCH
  • Ask a question
  • Forums
    • Wowza ClearCaster
    • Wowza Streaming Engine
    • Wowza Streaming Cloud
    • Wowza Player
    • Wowza GoCoder SDK
    • Wowza Developer Dojo
    • Topics
    • Questions
    • Articles
    • Users
    • Badges
  • Sign in
  • Community Home /
  • Wowza Streaming Engine /
  • General Forum /
avatar image
Question by Mohammad Assaf · Apr 02, 2016 at 09:34 AM ·

Wowza SYN Flood

Hi all,

My Wowza Streaming Server is running a chat application. Recently, I'm receiving too many SYN_RECV connections on Wowza port 1935, which flood Wowza and make it out of service after few minutes. Wowza log look like this:

INFO session disconnect 1952441416 -

INFO session disconnect 1955240045 -

INFO session disconnect 167151322 -

INFO session disconnect 1813218272 -

INFO session disconnect 382043424 -

INFO session disconnect 1634799669 -

INFO session disconnect 434196140 -

INFO session disconnect 208142553 -

INFO session disconnect 312967955 -

INFO session disconnect 1030735855 -

INFO session disconnect 532994105 -

INFO session disconnect 934484918 -

INFO session disconnect 1359350164 -

INFO session disconnect 937454906 -

INFO session disconnect 1952307730 -

INFO session disconnect 1206270288 -

INFO session disconnect 1876885468 -

INFO session disconnect 473147894 -

INFO session disconnect 711912881 -

INFO session disconnect 1059933984 -

INFO session disconnect 943715611 -

INFO session disconnect 608807573 -

INFO session disconnect 114624773 -

INFO session disconnect 1316608946 -

INFO session disconnect 916030303 -

INFO session disconnect 442604681 -

INFO session disconnect 1907610605 -

INFO session disconnect 450414311 -

INFO session disconnect 1970855212 -

INFO session disconnect 2023976249 -

INFO session disconnect 641520525 -

I tried to debug and detect these floods using netstat:

netstat -npt | awk '{print $6}' | sort | uniq -c | sort -nr | head

154 ESTABLISHED

116 SYN_RECV

113 LAST_ACK

44 CLOSE_WAIT

2 FIN_WAIT1

1 TIME_WAIT

1 Foreign

1

The flood size is not very big so the firewall is not detecting it but still annoying Wowza and force it to go down.

Can anybody help me in this problem??
Comment

People who like this

0 Show 0
10 |600 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users

2 Replies

· Add your reply
  • Sort: 
avatar image

Answer by Michelle B · Apr 06, 2016 at 09:25 PM

Hi,

It would be best if you can send a ticket to us with a zip copy of the following folders from your Wowza installation so that we can further investigate.

- conf/

- logs/

Michelle
Comment

People who like this

0 Show 1 · Share
10 |600 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users
avatar image Mohammad Assaf · Apr 11, 2016 at 12:23 PM 0
Share
Hi,

I have opened a ticket for support. They couldn't help me much, they suggested some iptables' rules which didn't work in my case.

I manage to stop the problem partially by changing Wowza TCP port to some random value and using psad to prevent port scanning. psad helped me a lot in blocking hackers IP address automatically.

Thanks anyway
avatar image

Answer by sal jefferson · Apr 11, 2016 at 06:40 AM

Thanks for updating this post and providing a worka around.

Regards,

Salvadore
Comment

People who like this

0 Show 0 · Share
10 |600 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users

Your answer

Hint: You can notify a user about this post by typing @username

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

Follow this Question

Answers Answers and Comments

1 Person is following this question.

avatar image

Related Questions

CPU for 10Gbit streaming 3 Answers

MJPEG to Wowza 1 Answer

ID3 text tags for IOS 1 Answer

WOWZA and Kaltura Ce5 5 Answers

iOS Wowza GoCoder can I use your library? Do you know any other good library? 2 Answers

Hot Topics
  • AWS Hosting
  • Mobile SDK
  • Deployment Options
  • Load Balancing
  • Content Security
Product Sign-in
  • Wowza Streaming Cloud
  • Wowza Player
Under the Hood
  • Developer Tools
  • Wowza System Status
  • Test Players
  • Developer IDE
Resellers
  • Find a Reseller
  • Reseller Portal
  • Become a Reseller
Company
  • About Us
  • Blog
  • News
  • Events
  • Careers
  • Customers
  • Partners
  • Contact Us
Stay Connected
Get Monthly Newsletter
Select a Language
  • English
    • English
    • Español
    • 日本語
    • 한국어
    • हिन्दी भाषा
    • 中文
    • русский язык

© 2005–2019 Wowza Media Systems, LLC. All rights reserved.   Terms | Privacy | Trademarks | Legal


Enterprise
Social Q&A

  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Create an article
  • Forums
  • Wowza ClearCaster
  • Wowza Streaming Engine
  • Wowza Streaming Cloud
  • Wowza Player
  • Wowza GoCoder SDK
  • Wowza Developer Dojo
  • Explore
  • Topics
  • Questions
  • Articles
  • Users
  • Badges