Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A recent article from UNIXy has suggestions to harden a Linux box against DDoS attacks.

Example of sysctl.conf

net.ipv4.tcp_syncookies = 1

net.ipv4.conf.all.rp_filter = 1

net.ipv4.conf.default.rp_filter = 1

kernel.pid_max = 65536

net.ipv4.ip_local_port_range = 9000 65000

Any other recommendations for hardening Linux against DDoS attacks?

share|improve this question
up vote 1 down vote accepted

You can also turn down the read/write socket buffers as well, which would decrease the amount of memory each inbound connection requires.

You'll have to actually test it out for your application and your hardware (yes, those settings can cause weird side effects depending on your NIC), since you may break more than you save depending on your traffic flow.

share|improve this answer
Thanks. The article references the TCP Tuning Guide at US Department of Energy site that also gives good background. I also found another useful Linux hardening article here… – Eureka Ikara Nov 24 '10 at 10:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.