The SYN (TCP connection request) attack is a common denial of service (DoS) technique.
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession ofSYN
requests to a target’s system
When a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this:
SYN
(synchronize) message to the server.SYN-ACK
back to the client.ACK
, and the connection is established.How to check the SYN attack on the server.
A quick and useful command for checking if a server is under ddos:
netstat -anp |grep ‘tcp\|udp’ | awk ‘{print $5}’ | cut -d: -f1 | sort | uniq -c | sort -n
That will list the IPs taking the most amounts of connections to a server. It is important to remember that ddos is becoming more sophisticated and they are using fewer connections with more attacking ips. If this is the case you will still get low number of connections even while you are under a DDOS.
Another very important thing to look at is how many active connections your server is currently processing.
netstat -n | grep :80 |wc -l
netstat -n | grep :80 | grep SYN |wc -l
The first command will show the number of active connections that are open to your server. Many of the attacks typically seen work by starting a connection to the server and then not sending any reply making the server wait for it to time out. The number of active connections from the first command is going to vary widely but if you are much above 500 you are probably having problems. If the second command is over 100 you are having trouble with a syn attack.
Solution:
First go with
echo 1 > /proc/sys/net/ipv4/tcp_syncookies
and then
Try with all these IPtables rule , there may other attacks too.
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags ACK,URG URG -j DROP
then,
service iptables save
service iptables restart
it should resolve your issue.
As a web designer and web developer your experience must have reached to new height, right? Further, you need to…
In today's digital landscape, timing is everything. Whether you're a social media manager, business owner, or content creator, the success…
Are you a website owner? Maintaining the website is the prime concern for any website owner. Yes, it’s equally important…
If you’ve planned to launch a WordPress website, you might get a question, “How do I log in to WordPress?”…
As the demand for virtual private servers (VPS) continues to grow, businesses and individuals are faced with a crucial decision:…