Re: strange log

[Dave Ockwell-Jenner <doj () solar-nexus com>]

Emilio Casbas wrote:

> Hi,
>
> We've seen  in the firewall's log of transparent proxy this messege 
> from different ips repeteadly :
>
> Apr 21 21:28:55 moria kernel: TCP: Treason uncloaked! Peer 
> external_ip/80 shrinks window 1466359669:1466360884. Repaired.
>
> We've googling, but we dont know if is an attack or a bad negotiation.
> Any suggestion?

I've seen this on some Linux webservers behind a Big IP load-balancer.  
More info on the message itself here:-

http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=a402f9.4j1.ln%40barfly

--
Dave Ockwell-Jenner
Solar Nexus Solutions
http://www.solar-nexus.com/


---------------------------------------------------------------------------
----------------------------------------------------------------------------