Synflood? 1

[humour]

I am deploying Mcafee firewall on my desktops. EPO constantly reports a Synflood attack from my server against one particular 98 client?

Anyone have an idea as to what this might be? A false positive perhaps?

What would my next step be to diagnose or solve the problem? There is no identified cuplrit - no worm, trojan or virus is mentioned?

 

[addus5]

A synflood is basically another computer trying to flood a machine with TCP/IP packets to create a DOS. The problem with desktop firewall is that it doesnt provide packet level detail on intrusions. It will be great when Mcafee lets us create our own Desktop Firewall signatures.

 

[humour]

Addus5 said>"It will be great when Mcafee lets us create our own Desktop Firewall signatures."

Is this a planned feature?

Is there a different tool I could get to do a packet level inspection? IF the attack is coming from my server does that mean there is a worm at work? I have the latest dat's and everything is coming up clean.

Thx again for the 1st reply.