Hello.
I noticed my internet connection was crawling, not even google.com would open. I checked syslog and noticed:
kernel: possible SYN flooding on port 3128. Sending cookies.
I also checked netstat -nat and noticed a lot about 1200 of ESTABLISHED connections from one ip address.
I called this person and told me no one was using that machine.
I have Squid Cache version 3.1.0.14 for i686-pc-linux-gnu and have Enable TCP SYN Cookie Protection
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
Is this a virus? Any suggestions?
