Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

[Linux - CentOS - Apache - VPS]

Last week my servers came under a SYN Flood attack, my hosting provider took some steps and resolved the issue. One of the things that they did was turn on SYN Cookies. I do know that all the traffic originated in South America.

My question is: Knowing which country that the attack is coming from is it possible to defend against the attack by blocking that country in my .htaccess file? Or does the attack happen on a lower level before the .htaccess is in the picture?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Knowing which country that the attack is coming from is it possible to defend against the attack by blocking that country in my .htaccess file?

No.

Or does the attack happen on a higher level before the .htaccess is in the picture?

Yes - SYN floods are essentially attacks on a construction of a connection, all way before Apache gets a chance to know what is going on. Wikipedia describes it nicely.

share|improve this answer
    
+1 Exactly, apache doesn't care about what's going on below layer 3. –  Chopper3 Oct 14 '12 at 16:42
    
If this person is using a script would it help to change the port that the site is served on? –  Adam Oct 14 '12 at 16:45
1  
Not really: 1) They are probably attacking a service on a port that can't change (like DNS) to stop you changing port 2) Even if you do change the port, you're going to have to leave something on :80 to redirect your traffic that'd you'd lose (e.g. Google). Lose-lose. –  Jay Oct 14 '12 at 16:48
    
One more question: I read that using a nginx as a reverse proxy to mitigate minor DDOS attacks webhostingtalk.com/showthread.php?t=949912 might have some affect, is this worth doing? –  Adam Oct 14 '12 at 16:54
    
It won't mitigate this kind of attack, if that's what you're asking. –  Jay Oct 14 '12 at 17:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.