# SSh connections

## deathiv

I have a gentoo server, and recently my network has been running very slowly. I tried many things and one of them was to use netstat to see what traffic was coming in.

It's been going for 2 hours now and no end in site of the thousands of lines that read tcp 0 0/1 livecd:<port> ip:ssh syn_sent/Established

Is this something to be worried about and what does it mean?

----------

## albright

It is said this is a symptom of denial of service attack.

does that make sense in your situation?

this site seems to have good advice:

http://nazeems.wordpress.com/2012/09/08/ddos-attack-measures/

----------

## deathiv

Yup, those symptoms fit, but as to why that happened I don't know, it seemed to stop when I rebooted, but if It starts up again I'll try to follow that guide.

----------

## Hu

Did your reboot change your IP address?  If so, the attack is now hitting someone else.

----------

## deathiv

IP's static. I changed some of the settings and am probably going to reassign SSHD to run on a different port than 22 so that the connections don't find the port.

----------

