Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

ITFRED

12 Posts

51040

November 18th, 2005 11:00

Syn_Received Attack ?

I am hoping some has possible answer to this. I worked on this problem for a couple weeks.

We have our internal network with Windows 2000 server with no internet connection to the outside and a couple Windows 98 computer with printers attached. The 98 computers are getting hit with Syn_Received requests and the server is working fine.

I recently setup a D-Link wireless router to access the internet, only three computer have access to this device, One runs Windows MCE 2005, XP Pro and XP Home. They all connect to the wireless and cabled to our internal network.

Only the MCE 2005 computer is causing the Syn_Received problem. If I disable his wiresless connection problem gone, I leave his wireless on but turn of the D-Link router problem gone, Remove internet connection to the router but have his computer connect to the router problem exists.

Thanks for any suggestions.

ITFRED

12 Posts

November 22nd, 2005 14:00

I have bad news, Tom left for the whole weekend with his computer, I can't try anything until monday.
 
He did not tell me he was leaving when I ran the route test on his computer this morning.
 
Just curious, how do you adjust broadcasting ? Can the broadcasting be turned off all together. He doesn't need to let everyone know about himself?
 
I'll keep in touch next week and let you know what happens.

LtLeary

241 Posts

November 22nd, 2005 14:00

I think we have all the pieces now and we have a couple of ways to resolve it.

1.  On the wireless adapter settings...under the ("the apdater uses the following settings.." make sure than ONLY TCP/IP is checked.  Uncheck MS Client and File/Print,  Reboot and then clear the nebios cache on the 98 machines. 

This should stop all your syn requests.  IF not, we will adjust the broadcast routing on the 192 interface.

 

LT

 

LtLeary

241 Posts

November 22nd, 2005 15:00

Yes, we can turn off the NBT on a per interface basis (this will DEFINITELY stop all the syn traffic on port 139!) Go into the IP Properties of the NIC (wireless in this case) click on advanced,  Click on the WINS tab, at the bottom, disable the Netbios over TCP/IP.  The wireless card will now stop requesting netbios resources and name broadcasts over IP.

ITFRED

12 Posts

November 22nd, 2005 17:00

Thanks you again, I'll try all of that as soon as I get my hands on that computer again.

ITFRED

12 Posts

November 29th, 2005 19:00

Thank You LtLeary,
 
  The changes to turn off netbois over tcp worked. I did also turn of MS Cleint just in case. He's working fine and were all able to print again.

LtLeary

241 Posts

November 29th, 2005 22:00

Glad to help.

 

LT

LtLeary

241 Posts

November 29th, 2005 22:00

Glad to help.

 

LT

Was this post helpful?

View All

No Events found!

Top