Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My questions are:

1.) What is a recommended "SYN PROXY SERVER" to filter bogus SYN Attacks and only forward "handshaked" valid connections to the host behind it (to be protected). I search the term, but did not find any direct hits/products,preferably open source/free?

2.) If there are not "ready built" Syn Proxy Servers, how can I build my own (with iptables?)

3.) Are Syn Proxy Servers recommended and usefull? Does anyone have any experience with it? (I otherwise might youse syncookies...)

Thanks very much! Markus

share|improve this question
up vote 2 down vote accepted

A SYN proxy server is nothing more than a bastion host that are setup to handle an awful lot of incoming half-built TCP connections, and only pass-off the completed ones. I honestly have no idea why you would use one; they're still vulnerable to failure by resource exhaustion (they've still got a finite amount of state space) and hence don't scale nearly as well as a good SYN cookie implementation.

Out of interest, can you share the source of your recommendation for a SYN proxy server?

share|improve this answer
Good Question: It's germanies (at least amongst the real IT geeks;-) most renowned Computer magazine called "ct". I never heard of the term "syn proxy" but as they mentioned it, I thought this must be someting very important I have to check out... – Markus Aug 27 '11 at 19:59
Journalists are rarely the people you want to be relying on for technology advice. – womble Aug 27 '11 at 21:50

You can substitute memory for CPU time by using a syn proxy which adds a secret to the socket address and computes a hash thereof which is used as the start sequence number of the server for the tcp connection.

No entries for half open connections will be added to the state table.

If a packet comes in (with the ack flag set)the acknowledgement number sent from the client minus 1 will be compared with the hash of the socket-address concatenated to the secret.

If the numbers don't match the packet will be dropped.

There is no limit on the number of half open connections only on the connection rate which depends on the CPU power.

share|improve this answer

The important thing to understand is that the SYN-cookie allows the server to respond to the initial SYN without creating a flow-table entry; it uses up way less ressources and keeps your server online; performance increases of up to 20x are common!

You should really read these background articles; SYNPROXY is really worth a try.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.