kernel: TCP: request_sock_TCP: Possible SYN flooding on port MyQbtPort. Sending cookies. Check SNMP counters.

Linux specific questions, problems.
Post Reply
postcd
Member
Member
Posts: 74
Joined: Wed Feb 24, 2016 11:25 am

kernel: TCP: request_sock_TCP: Possible SYN flooding on port MyQbtPort. Sending cookies. Check SNMP counters.

Post by postcd »

It happened always around the time when my network connection failed to work. Actually last like 12 hours connection is periodically interrupring every few minutes.

This "sudo journalctl" (Linux system log) log line:
kernel: TCP: request_sock_TCP: Possible SYN flooding on port 123456. Sending cookies. Check SNMP counters.
123456 being my qbt listening port. And indeed when i keep qBittorrent 4.4.2 stopped, network connection is OK.

I was searching this log message and someone here is talking about libtorrent-rasterbar settings change. But my qbt was rather long time not updated and my libtorrent neither (since beginning of the month 26 days at least). So out of sudden this. What should i check please?
unseen19
Veteran
Veteran
Posts: 188
Joined: Mon Mar 15, 2021 1:36 pm

Re: kernel: TCP: request_sock_TCP: Possible SYN flooding on port MyQbtPort. Sending cookies. Check SNMP counters.

Post by unseen19 »

get this already with Debian and another client. Not a real issue but it may be related to dropped packet, the SNMP counter was for me pointing to this cause. And indeed it was the case, too many connection for the setup I used. Not a problem and I ignored it
postcd
Member
Member
Posts: 74
Joined: Wed Feb 24, 2016 11:25 am

Re: kernel: TCP: request_sock_TCP: Possible SYN flooding on port MyQbtPort. Sending cookies. Check SNMP counters.

Post by postcd »

If anyone facing this, it is best to search the warning message in title on search engine.
Here are things that was tried to increase various network limits.

I have suspection that the cause of this flood may be a bug in qbittorrent where due to network outage (in my case possibly caused by non reliable nameservers in /etc/resolv.conf on VPN server) qbt maybe accumulate "connections" while not responding to user actions (no content inside qbt window). I may be wrong.
Post Reply