another seeming attack on my server's DirPort

[Michael Holstein]

> I assume a correlation between these two events, although I wonder how 
> (blocked) window shrinks could lead to this. My idea was to 
> automatically search in syslog for window shrink events and then block 
> the guilty IPs for 24 hours with iptables. But I hope that anybody 
> understands what was there exactly going on...

TCP windowing foolishness can be a result of ISP "bandwidth management".

~Mike.