Hello,

I have alot of SYN Attack where the source is the external IP Address of the appliance itself and destination 69.8.227.161 (www.sofaware.com).

Any ideas about the cause and the solution?

Tks

Johny

Hi Johny,
69.8.227.161 is not www.sofaware.com but rather some French web site, on what port do those SYN Attacks occur?

last are when users are connected in https to any web site. Thus I have this kind of log entry:
Source: Safe@Office IP
Port: 29825
Destination: IP of a website
Service: TCP 443
Reason: SYN Attack
Net: None

I have this each time 6 times in the same second with only Port change: in this example: ports are 29830, 29835, 29840, 29845, 29850

Try to go to Smart Defense - TCP - Syn Defender and increase the Maximum Time for Completing the Handshake value.