Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

My web server is currently under a DDOS attack I believe, the messages log is full of these kind of messages:

May 13 15:51:19  kernel: nf_conntrack: table full, dropping packet.  
May 13 15:51:19  last message repeated 9 times  
May 13 15:51:24  kernel: __ratelimit: 78 callbacks suppressed  
May 13 15:51:24  kernel: nf_conntrack: table full, dropping packet.  
May 13 15:52:06  kernel: possible SYN flooding on port 80. Sending cookies.  

and a netstat has a huge amount of the following:

tcp        0      0 SYN_RECV  
tcp        0      0           SYN_RECV  
tcp        0      0          SYN_RECV  
tcp        0      0     189-84-163-244.sodobr:63267 SYN_RECV  
tcp        0      0 SYN_RECV  
tcp        0      0 SYN_RECV  
tcp        0      0 SYN_RECV  
tcp        0      0     189-84-163-244.sodobr:63418 SYN_RECV  
tcp        0      0 SYN_RECV  
tcp        0      0  SYN_RECV  
tcp        0      0     netacc-gpn-4-80-73.po:52676 SYN_RECV  

tcpdump shows:

7:11:08.564510 IP > S 999692166:999692166(0) win 65535 <mss 1452,nop,nop,sackOK>  
17:11:08.566347 IP > S 605369055:605369055(0) win 65535 <mss 1440,nop,nop,sackOK>  
17:11:08.570210 IP > S 2813379182:2813379182(0) win 16384 <mss 1460,nop,nop,sackOK>  
17:11:08.571290 IP > S 281542700:281542700(0) win 65535 <mss 1452,nop,nop,sackOK>  
17:11:08.583847 IP > S 499413892:499413892(0) win 65535 <mss 1452,nop,nop,sackOK>  
17:11:08.588680 IP > S 2195084898:2195084898(0) win 65535 <mss 1460,nop,nop,sackOK>  
17:11:08.588773 IP > F 2315901786:2315901786(0) ack 2620913033 win 64240  
17:11:08.590656 IP > S 2813715032:2813715032(0) win 16384 <mss 1460,nop,nop,sackOK>  
17:11:08.591212 IP > S 4070423507:4070423507(0) win 16384 <mss 1400,nop,nop,sackOK>  
17:11:08.591254 IP > S 1790910784:1790910784(0) win 16384 <mss 1400,nop,nop,sackOK>  
17:11:08.591289 IP > S 578615626:578615626(0) win 16384 <mss 1400,nop,nop,sackOK>  
17:11:08.591591 IP > F 2316435991:2316435991(0) ack 2634205972 win 64240  
17:11:08.591790 IP > S 2813659017:2813659017(0) win 16384 <mss 1460,nop,nop,sackOK>  
17:11:08.593691 IP > F 2316834420:2316834420(0) ack 2629074987 win 64240  

I'm not sure what I can do to limit/mitigate this, currently no webpages are being served, any help gratefully appreciated.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 21:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

may need to just wait it out, or contact your upstream provider to have them start firewalling off this traffic. – cpbills May 13 '10 at 16:24

I've managed to solve this, here is the solution in case it helps anyone:

netstat -an | grep :80 | grep SYN_RECV

This will show all the IP's that are in this attack, simply block this list in your firewall and the attack won't have any effect.(I use APF so it was just apf -d for every IP)

You may have to run this command a few times after you block the IP's as I think netstat is limited to the amount of IP's it shows, I had to run it a few times before the command showed no IP's.

share|improve this answer
Note that your solution blocks even legitimate traffic (people who are really trying to establish a connection to use your site), so remember to clear your blocks when the attack is over or some users may have "mysterious problems". Also note DDoS will have new hosts coming in to it over time, so this may only be a temporary fix. – voretaq7 May 13 '10 at 17:04
I agree there may be some false positives caught up however the most important thing was to get the server working through this attack, I have been monitoring the situation since blocking these and thankfully there do not seem to be any more clients coming in to the attack. – Volex May 13 '10 at 17:29
This is totally wrong. Most synflooders use random source addresses and blocking hundreds of thousands of them will only make your firewall slower and archieve nothing. – Craig Jan 14 '15 at 23:59