Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile kernel with some options to improve protection against the SYN flood". I'm sorry if my question is too general but could you point out to me which kernel options it may be referring to? I downloaded the kernel and looked through all network options with make menuconfig but have not found or missed those options. Googling also didn't help.

Thank you.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

Yes, it is possible to re-compile the kernel with the protections for the Syn Flood attacks, but I don't see a reason for the same.

You need to re-compile the kernel in systems which don't have the capability to change kernel parameters by commands. But if you still want to do that, then you need to change the C code in the kernel.

For example, in Digital Unix, you change the two parameters in header files and then rebuild the operating system. In /usr/sys/include/sys/socket.h, change the SOMAXCONN definition so the 8 becomes 1024.

In /usr/sys/include/netinet/tcp_timer.h change the TCPTV_KEEP_INIT definition from 75*PR_SLOWHZ to 25*PR_SLOWHZ.

Then rebuild the kernel using Digital Unix procedures, which are unique to this Unix version.

You can also rebuild the kernel changing these same two parameters with Berkeley-derived Unix system.

However, they're found in different locations, namely /usr/src/sys/netinet/tcp_timer.h and /usr/src/sys/sys/socket.h.

After reading this, if you feel that you don't need to re-compile the kernel then use the following options to mitigate the syn flood attacks.

# echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
# echo 3 > /proc/sys/net/ipv4/tcp_synack_retries

To make the changes persistent across reboots, put these entries into /etc/sysctl.conf file

# TCP SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3

You can read more details about these at these URLs:

Hope this answers your question. Feel free to comment if you need more clarifications.

share|improve this answer
    
Digital Unix? Is it even relevant? Question is definitely about Linux and judging by file names Tru64 has a BSD derivative TCP/IP stack. –  SaveTheRbtz Dec 21 '12 at 23:29
    
Well, I am not sure if you have read my complete answer but I just gave an example here for the OS's where you can't change kernel parameters and you need to re-compile the kernel to change the settings. –  GeekRide Dec 22 '12 at 2:13
    
You could just give an example of some Linux compile-time tunables (i.e. some of them gist.github.com/2407652) it would be more relevant. –  SaveTheRbtz Dec 22 '12 at 6:34
    
I wrote something which I thought was the right way to explain the scenario to Andrew. If you feel that there is something which needs to be changed/improved in my answer, please feel free to edit my answer. –  GeekRide Dec 22 '12 at 6:55
add comment

Not sure about you're article but the common way for syn flood protection is to set /proc/sys/net/ipv4/tcp_syncookies.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.