Firewall events log "type of TCP flood/14"

[MortalSeg]

We are currently getting a lot of TCP flooding attacks. I have a short question regarding the log entry "TCP flood/14". What does the number 14 stand for? Does it represent some IP or TCP flags? Would help me setting up the filters.

Thanks in advance!

[soja]

If you are seeing the notice in the event log about the TCP flood, there is no need to set up your own filter for it. When NFO's system detects the attack, they apply a filter at the router to block the traffic, so it never reaches your game server or machine.

[MortalSeg]

Apparently it is detected too late. The laggs ingame are some minutes long before this event shows up. That's why I want to filter such attacks directly.

[soja]

Apparently it is detected too late. The laggs ingame are some minutes long before this event shows up. That's why I want to filter such attacks directly.

While the server is lagging, you can use the packet capture tool in detailed mode to get a snapshot of the incoming packets to make a filter.

[MortalSeg]

While the server is lagging, you can use the packet capture tool in detailed mode to get a snapshot of the incoming packets to make a filter.

We are doing that but not always right in time.

So if anyone knows what the number stands for, please inform me.

[MortalSeg]

Okay, looks like the attack was tcp-ack flooding (probably reflected) against a closed port. I don't know why it's so effective against our service, hopefully a rate-limit filter will help.