SYN FLOOD CAUSED BY FIREFOX

User Help for Mozilla Firefox
Locked
arisv44
Posts: 6
Joined: October 2nd, 2008, 2:39 am

SYN FLOOD CAUSED BY FIREFOX

Post by arisv44 »

Hi all,
this problem appears in my dsl modem router only when i open youtube with ffox NEITHER with IE NOR with chrome:
"10/02/2008 11:37:00 **SYN Flood to Host** 192.168.2.5, 3602->> 209.85.135.118, 80 (from ATM1 Outbound)"

I simple cannot see the images.

I 've open ff with safe mode and changed my profile but nothing...
Last edited by Daifne on October 2nd, 2008, 5:44 am, edited 1 time in total.
Reason: unnecessary formatting removed
VanillaMozilla
Posts: 13808
Joined: November 7th, 2005, 11:26 am

Re: SYN FLOOD CAUSED BY FIREFOX

Post by VanillaMozilla »

OK, I'm going to take a stab at this. Have you tinkered with the network settings in Firefox? Or installed one of those optimizing extensions or whiz-bang-speedem-up tuning things?

EDIT:
A few possibilities that I found with Google. (Remember, Google is your friend.)

1. Many routers have the following option:
"Maximum incomplete TCP/UDP sessions number from same host"
Commonly the default value is 10. People report that changing it to 30 or 50 solves problems.

Here's a great example describing a problem with Google Maps:
http://forums.speedguide.net/showthread.php?p=2168551 (4th message)

2. Here's another one: http://cocaman.ch/wp/2007/07/google-maps-syn-flood/
network.http.max-persistent-connections-per-server
This is why I asked if you had been tinkering.

3. This too:
"Belkin have admitted (unofficially through tech support), there is a problem with the Wireless on the F1PI242EG...."
http://forums.whirlpool.net.au/forum-re ... 17692.html
Guest
Guest

Re: SYN FLOOD CAUSED BY FIREFOX

Post by Guest »

Everything OK

It was the router matter: "maximum TCP/UDP sessions from same host"

Thanks a lot Vanilla Mozilla!
VanillaMozilla
Posts: 13808
Joined: November 7th, 2005, 11:26 am

Re: SYN FLOOD CAUSED BY FIREFOX

Post by VanillaMozilla »

You're welcome. A case of an over-eager router, I guess.
arisv44
Posts: 6
Joined: October 2nd, 2008, 2:39 am

Re: SYN FLOOD CAUSED BY FIREFOX

Post by arisv44 »

# DoS Detect Criteria
Lowpull
Guest

Re: SYN FLOOD CAUSED BY FIREFOX

Post by Lowpull »

When I try open a page to http://wickedweasel.com/nl-nl my router will log syn flood to host.
No pictures are shown and the website will lock. Opening this page in Internet Explorer works perfectly.
My router is a Siemens Gigaset (experiabox). In Firefox are two plugin's: Logme in and Plain text.

What can be the problem?
VanillaMozilla
Posts: 13808
Joined: November 7th, 2005, 11:26 am

Re: SYN FLOOD CAUSED BY FIREFOX

Post by VanillaMozilla »

Whatever causes enough extra connections will do it. Maybe you've changed network connections, or used one of those dubious speed-em-up tune Firefox extensions. See if pipelining is enabled, for example. Or other extensions. Who knows what could have been changed.

The easiest way to fix this from the Firefox side is to try it with a new profile. Search the Knowledge Base (over there ==>) for the Profile Manager and follow the directions carefully. The real way to fix it is to fix your router. Read the articles. Also, when you are troubleshooting the router, look for DoS Detect criteria. Of course, there is a very small chance that you arebeing syn-flooded, but probably not.
Rambling Syd
Guest

Re: SYN FLOOD CAUSED BY FIREFOX

Post by Rambling Syd »

With the Belkin ADSL2, Google Images et al can cause "SYN FLOOD ATTACK" but there seems to be no way to adjust "Maximum incomplete TCP/UDP sessions number from same host". However if you log in via 192.168.2.1/firewall_spi_h.stm you get into a hidden page where you can do so. I reset mine from 10 to 30 and have never had the problem again.
FlintStash
Guest

Re: SYN FLOOD CAUSED BY FIREFOX

Post by FlintStash »

Rambling Syd wrote:With the Belkin ADSL2, Google Images et al can cause "SYN FLOOD ATTACK" but there seems to be no way to adjust "Maximum incomplete TCP/UDP sessions number from same host". However if you log in via 192.168.2.1/firewall_spi_h.stm you get into a hidden page where you can do so. I reset mine from 10 to 30 and have never had the problem again.


I own a Belkin ADSL FSD7632-4 (label on bottom) and your solution is working properly now.
Thanks
User avatar
DanRaisch
Moderator
Posts: 127166
Joined: September 23rd, 2004, 8:57 pm
Location: Somewhere on the right coast

Re: SYN FLOOD CAUSED BY FIREFOX

Post by DanRaisch »

Thanks for your report.

Locking this due to the age of the original posts.
Locked