We get quite few messages like these in our dmesg log on various servers:
TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: Peer 18.104.22.168:33760/60908 unexpectedly shrunk window 3159965547:3159965552 (repaired)
I have been told that these are denial of service attack on our infrastructure. If you can keep the TCP connection open indefinitely you can tie up system resources and stop legitimate clients from being able to connect to your servers.
How could I actually identify if these are and actual DOS attacks or some thing a lot less harmful?