We have a linux server (Debian-Lenny) with solid-state drive, without hard disk classic. He's use as a router, so traffic is only for forward.
We want to monitor connexions in able to find some syn-flood. Netstat could help us, but we have many traffic, almost around 150 Mbit/s, and netstat who look in '/proc/net' block the traffic, so it's not a method that we can use. Actually we use iptables rules with 'hashlimit-*' to verify that: from a source there is not too many connexion by minute. But not easy to adjust, for what is 'too many' for some network behind us.
Have somebody any idea what can we do?
Thank for the help,