Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I dump the TCP packets to get a better idea to know which website is being attacked?

Here is what I have in my logs:

May  4 23:10:26 host kernel: [2130002.635000] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=51.120.142.200 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=64643 PROTO=TCP SPT=6433 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:26 host kernel: [2130002.635046] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=162.35.168.3 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=32964 PROTO=TCP SPT=38463 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:26 host kernel: [2130002.635139] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=168.112.108.150 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=28524 PROTO=TCP SPT=12511 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:26 host kernel: [2130002.635174] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=134.210.162.215 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=34079 PROTO=TCP SPT=51221 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:26 host kernel: [2130002.635310] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=54.114.224.137 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=52817 PROTO=TCP SPT=59374 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:28 host kernel: [2130004.631516] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=17.17.80.156 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=57197 PROTO=TCP SPT=25322 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:30 host kernel: [2130006.628179] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=169.95.251.80 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=85 PROTO=TCP SPT=27412 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:32 host kernel: [2130008.624842] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=114.73.202.181 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=26470 PROTO=TCP SPT=15474 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:34 host kernel: [2130010.621519] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=162.134.103.25 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=35261 PROTO=TCP SPT=31523 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:36 host kernel: [2130012.618218] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=99.25.73.187 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=15447 PROTO=TCP SPT=56379 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0
May  4 23:10:38 host kernel: [2130014.614953] Firewall: *SYNFLOOD Blocked* IN=eth0 OUT= MAC=00:26:9e:3d:14:e0:00:12:44:99:b8:00:08:00 SRC=200.93.185.230 DST=1.2.3.4 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=24173 PROTO=TCP SPT=12497 DPT=80 WINDOW=0 RES=0x00 SYN URGP=0

I would like to know which site is being hit so it can be dropped from the server. I have 100s of websites/domains on this same IP.

EDIT: does this help? This was with (host.mydomain.com does not point to the ip being attacked)

tcpdump -vvv > dump
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
^C78 packets captured
188615 packets received by filter
188484 packets dropped by kernel

host.myhostname.com.39753 > google-public-dns-a.google.com.domain: [bad udp cksum 7b5b!] 43080+ PTR? 37.145.115.216.in-addr.arpa. (45)
23:33:26.591283 IP (tos 0x0, ttl 64, id 46350, offset 0, flags [DF], proto UDP (17), length 71)
    host.myhostname.com.7664 > google-public-dns-a.google.com.domain: [bad udp cksum 7e14!] 50588+ PTR? 67.247.76.69.in-addr.arpa. (43)
23:33:26.591313 IP (tos 0x0, ttl 246, id 40924, offset 0, flags [none], proto TCP (6), length 40)
    139.130.25.28.35498 > host.myhostname.com.http: Flags [S], cksum 0x1ea7 (incorrect -> 0x5c03), seq 3788177408, win 0, length 0
23:33:26.686457 IP (tos 0x0, ttl 246, id 6637, offset 0, flags [none], proto TCP (6), length 40)
    255.233.72.118.adsl-pool.sx.cn.47086 > host.myhostname.com.http: Flags [S], cksum 0x8df9 (incorrect -> 0xb6e9), seq 2650210304, win 0, length 0
23:33:26.702689 IP (tos 0x0, ttl 246, id 58506, offset 0, flags [none], proto TCP (6), length 40)
    client-86-25-29-28.midd-bam-1.adsl.virginmedia.com.65189 > host.myhostname.com.http: Flags [S], cksum 0x65eb (incorrect -> 0x3851), seq 3270180864, win 0, length 0
23:33:26.723599 IP (tos 0x0, ttl 246, id 16306, offset 0, flags [none], proto TCP (6), length 40)
    10.23.136.178.childkey-notif > host.myhostname.com.http: Flags [S], cksum 0x0545 (incorrect -> 0x2119), seq 2983329792, win 0, length 0
23:33:26.723656 IP (tos 0x0, ttl 64, id 46482, offset 0, flags [DF], proto UDP (17), length 72)
    host.myhostname.com.25322 > google-public-dns-a.google.com.domain: [bad udp cksum 949b!] 27893+ PTR? 128.254.19.14.in-addr.arpa. (44)
23:33:26.745875 IP (tos 0x0, ttl 64, id 46504, offset 0, flags [DF], proto UDP (17), length 71)
    host.myhostname.com.icl-twobase4 > google-public-dns-a.google.com.domain: [bad udp cksum 6be5!] 60864+ PTR? 167.6.71.169.in-addr.arpa. (43)
23:33:26.797031 IP (tos 0x0, ttl 64, id 46555, offset 0, flags [DF], proto UDP (17), length 72)
    host.myhostname.com.49262 > google-public-dns-a.google.com.domain: [bad udp cksum 487!] 64053+ PTR? 140.53.122.44.in-addr.arpa. (44)
23:33:26.881726 IP (tos 0x0, ttl 246, id 48847, offset 0, flags [none], proto TCP (6), length 40)
    23-30-27-202-static.hfc.comcastbusiness.net.62003 > host.myhostname.com.http: Flags [S], cksum 0x68d5 (incorrect -> 0xf99f), seq 1314652160, win 0, length 0
23:33:26.881755 IP (tos 0x0, ttl 246, id 7932, offset 0, flags [none], proto TCP (6), length 40)
    4.57.107.39.57966 > host.myhostname.com.http: Flags [S], cksum 0x0701 (incorrect -> 0xc4fc), seq 1447821312, win 0, length 0
share|improve this question
add comment

1 Answer

Use wireshark or tcpdump with -vvv and look through the packets for a DNS name. The SYN flood may just be pointed at your IP address.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.