19-Jun-2018 03:07:40 :%SECURITYSUITE-I-SECSYNBLOCKED: 03:07:40 19-Jun-2018: A TCP SYN Attack was identified on port Po2. TCP SYN traffic destined to the local system is automatica[0mMore: <space>, Quit: q or CTRL+Z, One line: <return> lly blocked for 60 seconds.
That basically means you've been exposed to SYN flood attack coming on port 2 on your SG350 switch on June 19, 2018, so the switch had detected the attack and reacted by denying the traffic destined to your local system for 60 seconds. That might be a malicious client or malware running inside of your network. It is a good approach to have antivirus/anti-malware software on your end client machines so that you can be fully protected.
More information about the TCP SYN Flood attack can be found at:
This way you can look into and match specific fields in the packet (for example, source and destination IP, protocol, and length.) You can also display the top ports or protocols used in the captures, which could help identify potential DoS activity.
There seems to be no counters for this issue on the switch
If TCP is blocked i cannot connect to the host to troubleshoot. In my case it seems some TCP SYN to port 53 from a microk8s Raspberry PI
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
